Hi @Sultan77  I think there may be some confusion in this thread. It sounds like you're creating an Enterprise Security Correlation Search, right? The screenshots you posted where you specify host=$host$ in the DrillDown search is for when a notable event has been created and a security analyst is viewing it. They'll be presented a DrillDown search link designed to help take them to the event(s) which caused the notable to fire.  Is that your understanding? Is it the drilldown you are wanting to restrict further, rather than the initial correlation search which created the notables? If so you need to find other fields in the returned data that can limit the events returned in the drilldown, such as as eventID. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @dania_abujuma  Just to check - have you created the "os" index on your indexers? Are you able to see the _internal logs for these forwarders? This will help determine if the issue is sending, or receiving the data.  Do you see any reference to these inputs (and any errors?) in the $SPLUNK_HOME/var/log/splunk/splunkd.log file? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @ramuzzini  How about this for a different approach?  | eval json_data = "{" . replace(_raw, "(?<=,|^)([^=]+)=([^,]+)", "\"\\1\":\"\\2\"") . "}" | spath input=json_data | table Loc, Comp, User, Date Here is a full working example: | makeresults count=3 | streamstats count | eval _raw=case(count=1, "Loc=Warehouse, Comp=WH-SOC01, User=username1, Date=2025-03-18", count=2, "Loc=Warehouse, Comp=WH-SOC02, User=username2, Date=2025-03-20", count=3, "Loc=Warehouse, Comp=WH-SOC03, User=username1, Date=2025-03-24") | fields _raw | eval json_data = "{" . replace(_raw, "(?<=,|^)([^=]+)=([^,]+)", "\"\\1\":\"\\2\"") . "}" | spath input=json_data | table Loc, Comp, User, Date Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will   ... View more

Hi  The license dashboard often uses the RolloverSummary data, which is generated at midnight (usually). If its been less than 24 hours then this could be why you are seeing no data. Also, the search uses a macro `set_local_host` which basically uses the rest endpoint in the SPL below to get the current hostname, this means it may not show the data for the previous 60 days because it will have been saved under the old hostname. When you run the following, do you get your old server name, or new one? |rest splunk_server=local /services/server/info | table host Does this match a host you see in the below? index=_internal source=*license_usage.log* Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @SrinivasuluS  Just a follow up regarding maxTotalDataSizeMB being used in some of these queries that I feel I should raise, the default value for this if unchanged is 500GB, if you have 10 indexes and "filled" them all then you would consume 50TB of storage, but if your storage location is smaller than 50TB (or rather, the total of your maxTotalDataSizeMB) then you will start losing older data *before* the maxTotalDataSizeMB is reached. Similarly, that value is per-indexer, so if you have 10 indexers then your "total available storage" for each index is 10*maxTotalDataSizeMB (10x500GB = 5TB) - but, if you have 3 copies of the data then you'll chew through that storage quicker, if that makes sense? Also, if you have frozenTimePeriodInSecs set to 90 days, but after 45 days you've already reached your maxTotalDataSizeMB for that index then you'll never make it to the 90 day retention you're expecting. And the same for the reverse, if maxTotalDataSizeMB is set to 90 days and after 90 days you've used 50GB, you're never going to "fill" it up maxTotalDataSizeMB (unless you start sending more data)! Essentially what I'm trying to say is, these searches might not give the answer you think you're getting unless other factors are considered [which you might already be aware of - but wanted to hightlight for others who might see these responses 🙂 ] Hopefully this make sense, but if you want any further guidance on how to apply these searches to your environment then please let us know a bit more about your end-goal here, along with details of your environment (How many IDX, is it a cluster, what is your Replication and search factor, single or multi-site, any other settings changed like TSIDX reduction, presumably not using SmartStore? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @doniaelansasy  Did you make any changes to your indexes.conf ? Is it possible something else could have changed in the system? Changing the configuration of your inputs.conf can not result in existing data being removed. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @SrinivasuluS  I wonder if the following should work for you? Or at least help get some way there, Run this search across "All Time" to get the size since the start of your onboarding. | dbinspect index=* | stats sum(sizeOnDiskMB) as sizeOnDiskMB by index This gives the sizeOnDisk in MB for each index, the amount of available space might depend on your configuration. Do you have a single storage location/volume for all indexes and both hot/warm/cold buckets? Do you know the size of your disk or do you need to look in Splunk for this info to? This will help build out a final query for you to use. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @samalchow  Please let us know if you are getting _internal logs for the UFs not sending the windows data as this might help determine if its a Windows permissions issue on the collection of event data, or an issue sending 🙂 Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @SN1  If you look further back, when was the last event?  Have a look using this search looking back at least to the time of the last event from the missing servers. | tstats latest(_time) as _time where index=_introspection by host Then run the search 5-10 minutes later. Are the times of the last events different for the missing host? If so this would suggest that they are having issues sending logs and that they are delayed, rather than not sending at all. In addition it would be worth checking the Splunk log of the missing host directly, check out $SPLUNK_HOME/var/log/splunk/splunkd.log - are there any references to blocking or output errors? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will   ... View more

Hi @splunkkk  Are you still getting other logs / _internal logs from the HF? This will help determine if the error is with sending or receiving data. Check the $SPLUNK_HOME/var/log/splunk/splunkd.log for any errors relating to SSL/TLS/input/output/queues Use netcat to check the expected port is open (nc -vz -w1 localhost <port>) - This assume netcat is installed and as "nc" binary. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @samalchow  Are you getting logs into _internal for the other hosts? This might help determine if the issue is with the inputs or the outputs of the UFs. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @ayomotukoya  If you're using draw.io then check out https://github.com/livehybrid/splunk_drawio_icons If not you can crop the images you need from https://docs.splunk.com/images/8/8b/Splunk_Documentation_Icons_August2018.png  Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @avi123  Do you get the 3 alerts all at the same time, or 7 mins apart? Regarding the "Suppress results" under the Throttle checkbox, what did you put into this textbox? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @MichaelM1  Just to check - is your IF a UF or HF?  If its a UF the transforms might not apply without force_local_processing=true Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @BRFZ  I think the best place to start for setting up SSL/TLS is at https://docs.splunk.com/Documentation/Splunk/9.4.1/Security/ConfigureSplunkforwardingtousesignedcertificates Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @spisiakmi  Try adding the following to your search, is this what you are looking for? | append [| gentimes start=-1 increment=1m] | eval _time=coalesce(starttime, _time) | sort 0 _time | filldown state | eval count=1 | timechart latest(count) by state   Here is the full search I used which loads in some sample data: | makeresults count=12 | streamstats count as row_number | eval _time=case( row_number==1, strptime("2025-03-23T13:25:33.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==2, strptime("2025-03-23T13:21:46.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==3, strptime("2025-03-23T13:05:01.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==4, strptime("2025-03-23T11:23:35.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==5, strptime("2025-03-23T11:23:19.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==6, strptime("2025-03-23T11:21:41.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==7, strptime("2025-03-23T11:20:04.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==8, strptime("2025-03-23T11:19:57.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==9, strptime("2025-03-23T10:47:01.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==10, strptime("2025-03-23T10:46:55.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==11, strptime("2025-03-23T10:46:28.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z"), row_number==12, strptime("2025-03-23T10:46:21.000+0100", "%Y-%m-%dT%H:%M:%S.%3Q%z") ) | eval state=case( row_number==1, "Störung", row_number==2, "Verteilzeit", row_number==3, "Personal fehlt", row_number==4, "Produktion ON", row_number==5, "Wartung", row_number==6, "Störung", row_number==7, "Produktion OFF", row_number==8, "Produktion ON", row_number==9, "Produktion OFF", row_number==10, "Produktion ON", row_number==11, "Verteilzeit", row_number==12, "Verteilzeit" ) | eval dlt=case( row_number==1, null(), row_number==2, "227.000", row_number==3, "1005.000", row_number==4, "6086.000", row_number==5, "16.000", row_number==6, "98.000", row_number==7, "97.000", row_number==8, "7.000", row_number==9, "1976.000", row_number==10, "6.000", row_number==11, "27.000", row_number==12, "7.000" ) | append [| gentimes start=-1 increment=1m] | eval _time=coalesce(starttime, _time) | sort 0 _time | filldown state | eval count=1 | timechart latest(count) by state Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @sureshkumaar  I think one of the issues here is that your transforms are in the wrong order, a list of TRANSFORMS are applied in order and do not stop once the criteria of one is met, this means in this situation it would apply the route_fortigate_traffic index change, then route_nix_messages which would just set it to os_linux regardless. Change the order of these to first set os_linux and then override to the nw_fortigate index if appropriate. That being said, it sounds like neither of your transforms are being applied? Please could you confirm the following: Does [source::.../TUC-*/OOB/TUC-*(50M)*.log] definately match your file name? Please could you provide a sample filename/path? Are you sending the data from a Universal Forwarder (UF) or Heavy Forwarder (HF)? Data from a HF wont be reparsed using this approach. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will   ... View more

Hi @MichaelM1  You're right that appling the _meta on the WinEventLog props stanza on the IF may double stamp it if it has already been applied on the UF, this is why we need to use the INGEST_EVAL with the COALESCE eval so that if it already exists then it will use the existing value, else uses a default value. I am a bit confused as to why the props/transforms you applied did not work though. Does it apply to any of the data (e.g. just the IF's own data being sent)?  You may wish to add a 3rd "debug" field to see if that gets applied to any of your data that reaches the indexers.  One thing I dont think I asked which is probably pretty important... is your IF a HF or UF? I have been testing using HF as the IF. @PickleRick you mentioned this wouldnt work if the data comes from a HF, I think @MichaelM1 is sending from a UF here, however in my testing I tried HF->IDX with the INGEST_EVAL transform on the IDX and this does work, despite the data already being parsed by the HF. I'm fairly sure I've used INGEST_EVAL plenty of times on parsed data but I will double check, perhaps I was using it on a RULESET instead.  @MichaelM1 Let me know if your IF is a UF/HF so I can update my testing 🙂 We will beat this...! Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @MBristow7  The App, which mainly contains dashboards by a community developer isnt Cloud Compatible because the dashboards inside it have not been upgraded to v1.1 which is to upgrade jquery. Just to clarify, are you wanting this app to visualise existing data that you are ingesting in to Splunk? If so there may be some mileage in downloading the app and then recreating the dashboards yourself in your Splunk Cloud environment using the dashboard files in the app. However, if you are looking to bring Salesforce data in then you probably actually need the Splunk Add-on for Salesforce which is cloud compatible. As well as the inputs to collect the data, this also includes a variety of search-time field extractions in props/transforms and a savedsearch for populating a lookup - so really it serves as both an add-on and app (Collection & Visualisation) Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @fatsug  By default these are typically used: homePath = $SPLUNK_DB/<indexName>/db coldPath = $SPLUNK_DB/<indexName>/colddb thawedPath = $SPLUNK_DB/<indexName>/thaweddb Where hot/warm buckets are in homePath and cold buckets are in coldPath.  thawedPath is used for restoring buckets which have been frozen out to an external location using a coldToFrozenScript - Its a required setting even if you dont plan to freeze/restore data. In terms of home vs cold - A lot of customers may choose faster storage (such as SSD) on the homePath location, versus cheaper/slower storage for coldPath where older data is typically located. Your assumptions around using volumes are correct. You can specify multiple volumes on the same path, making sure that the combined maxVolumeDataSizeMB for your volumes doesnt exceed the disk size! You are essentially using it as a logical separation in the same physical space. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will   ... View more

Hi @SplunkSN  Version 2.0.8 of the Splunk Add-on for AppDynamics is Splunk Cloud compatible, so you should be able to install this already on your Splunk Cloud stack. The latest version (3.1.2) was uploaded to SplunkBase 3 days ago on the 18th March so it is likely waiting for the AppInspect vetting process to complete before it is marked as being compatible for Splunk Cloud. I would be very surprised if it failed the Cloud vetting process as it is developed internally at Splunk 🙂  Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @BRFZ  If your data is landing in Splunk then the next thing you'll probably want to start looking at is ensuring that it is CIM compliant and then starting to enable/create Rules, based on your requirements. To do this properly you want to make sure it is planned out well and have clear requirements, rather than enabling lots of Rules sporadically! Some good resources to check out are: Splunk Lantern - https://lantern.splunk.com/Security/Getting_Started/Getting_started_with_ES Splunk Security Essentials - https://splunkbase.splunk.com/app/3435 Splunk ES 101 video - https://www.youtube.com/watch?v=Euas6lCK-LE Splunk ES Certified Admin training path - https://www.splunk.com/en_us/training/certification-track/splunk-es-certified-admin.html Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @molla  This isnt something you can do with a cluster map - although a Choropleth map does highlight the regions - but - the bins that it groups your stats into is quite cumbersome to manage. It might work well for what you need though? Have you already tried a Choropleth map? Another option might be to use https://splunkbase.splunk.com/app/5166 Simple Map Viz app which looks like it should do what you are looking for. Please note that this is only for an XML (Not dashboard studio) dashboard. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more