Ive raised a bug for this with the above info. ... View more

I'm assuming it goes from EXECUTING->WAITING->COMPLETED? Try something like this: index="events" NOT "COMPLETED" [index="events" reference=* "EXECUTING" | dedup reference | table reference] | stats min(_time) AS startTime max(_time) as endTime latest(reference) as reference by reference | eval duration = endTime-startTime The part in brackets should return all the references that have been in executing state, and then include that in a search for events that have not completed. Instead of transaction this uses min/max _time to get the duration, which should be quicker... ... View more

We used to have the following in our splunk-launch.conf , however we found that after a certain number of exclusions it stopped working (around ~270 char line...??): NO_PROXY=127.0.0.1,169.254.169.254,codebuild.eu-west-2.amazonaws.com,config.eu-west-2.amazonaws.com,dynamodb.eu-west-2.amazonaws.com,ec2.eu-west-2.amazonaws.com,ec2messages.eu-west-2.amazonaws.com,elasticloadbalancing.eu-west-2.amazonaws.com,events.eu-west-2.amazonaws.com,execute-api.eu-west-2.amazonaws.com,kms.eu-west-2.amazonaws.com,logs.eu-west-2.amazonaws.com,monitoring.eu-west-2.amazonaws.com,s3.eu-west-2.amazonaws.com,secretsmanager.eu-west-2.amazonaws.com,servicecatalog.eu-west-2.amazonaws.com,sns.eu-west-2.amazonaws.com,ssm.eu-west-2.amazonaws.com Now we have the following config in server.conf : [proxyConfig] http_proxy=egress.yourproxy.com:443 https_proxy=egress.yourproxy.com:443 no_proxy=::1,localhost,127.0.0.1,169.254.169.254,codebuild.eu-west-2.amazonaws.com,config.eu-west-2.amazonaws.com,dynamodb.eu-west-2.amazonaws.com,ec2.eu-west-2.amazonaws.com,ec2messages.eu-west-2.amazonaws.com,elasticloadbalancing.eu-west-2.amazonaws.com,events.eu-west-2.amazonaws.com,execute-api.eu-west-2.amazonaws.com,kms.eu-west-2.amazonaws.com,logs.eu-west-2.amazonaws.com,monitoring.eu-west-2.amazonaws.com,s3.eu-west-2.amazonaws.com,secretsmanager.eu-west-2.amazonaws.com,servicecatalog.eu-west-2.amazonaws.com,sns.eu-west-2.amazonaws.com,ssm.eu-west-2.amazonaws.com I hope this helps! ... View more

Sorry, long day...should be head Updated the original one. ... View more

Hi, Try this (it might need slight tweaking for your file): index=yourIndexes [| inputlookup cis_urls.csv | rename URL AS url| table url] | stats count by url | head 10 Or, you could find the top URLs first (see below) which could be more performant. ... View more

It might not be there already but you should be able to add it there anyway. Sorry, there isnt a nicer way of doing it 😞 Cheers ... View more

Can you post the code that you're using to submit the API request? You should be fine if you start the query with | (no space before it). ... View more

Yes that is true - You'd be as well to add the static entry. but...now you know about makeresults ! ... View more

Are you able to upload a picture so I can see what it looks like? Thanks ... View more

Here is a simpler example of how this might work: index=* | timechart count by source | append [search index=* | timechart count by sourcetype] For your search this might work: index=nix sourcetype=cpu host="host a" CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host | append [search index=nix source=vmstat sourcetype=vmstat tag=memory host="host a" | timechart limit=0 max(memUsedPct) by host] ... View more

It isnt really ideal - but you can edit the following file: $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/css/bootstrap-enterprise.css Have a play around changing the CSS for .wrapper-container and .account . I added the following which top-right-aligned the login page. .account { top: 0; } .wrapper-container { float:right; } ... View more

And then restart splunk 🙂 ... View more

You can use the following command: $SPLUNK_HOME/bin/splunk set web-port 8080 (Where 8080 is your new port). Alternatively you can edit the web.conf (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf) Put the following in $SPLUNK_HOME/etc/system/local/web.conf (create if doesnt exist) [settings] httpport = 8080 ... View more

Whoops - Should have read more carefully! Sorry but that is a bit trickier. Its not possible to do a traditional lookup. You're best bet would probably be a time-based lookup so your lookup at searchtime is accurate to the time the data was indexed...it depends on your specific case. Sorry I couldnt help further! ... View more

Hi, by specifying OUTPUT as part of your lookup command, it will overwrite fields in your results with the value from the lookup if the fields match. e.g: sourcetype=access_* | stats count by status | lookup status_desc status OUTPUT description In this example, any previous description field will be overwritten. However, if the field in your event is called myDescription then you would use: sourcetype=access_* | stats count by status | lookup status_desc status OUTPUT description AS myDescription I hope this helps. ... View more

Hi, Do you have a unique ID for each job that runs? If so - try something like this: index=yourIndex [search index=yourIndex status="STARTED" | fields yourUniqueIDField] | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS" This should give you data for everything that has Started, but where there is not a FAILURE or SUCCESS log line. You might actually find you dont need the subsearch, the following might also work: index=yourIndex status=* | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS" I hope this helps! ... View more

Hi, Are you planning to continue indexing to both indexers once your remove indexer clustering, or just one at once? Dont forget that you'll end up using twice your license amount if you index it on multiple indexers that arent in a cluster. ... View more