Hey abhi04, Replication factor defines how many replicated buckets you want .Suppose you have clustered environment of 3 indexers and if you keep replication factor as 3,then each indexer would have replicated copies of the other indexers. If the indexer fails,the other two indexers will have the replicated copies and those will become searchable.Only the primary copies that were available in the indexer that failed, the other indexers would make only those copies searchable. Search factor is the number of copies that you want to be available in Splunk. Note: If the search factor is high, all the index files are replicated and that can account on your storage. You need to decide replication factor and search factor as per how you want high availability to be set. You can refer this doc for detailed explanation: http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Basicclusterarchitecture Let me know if this helps!! ... View more

Do you have a list of ip addresses and their hostnames? If yes then you can add this list as lookup and automate the lookup to get the hostnames at search time Reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/DefineanautomaticlookupinSplunkWeb Let me know if this helps!! ... View more

Hey ranjitbrhm1, Yes Deployment server controls all UF's. You can refer this doc: http://docs.splunk.com/Documentation/Splunk/7.0.2/Updating/Configuredeploymentclients Let me know if this helps!! ... View more

You can refer this link to understand how bucket ages: http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/HowSplunkstoresindexes When you mention frozenTimePeriodInSecs, this parameter decides the retention of bucket from coldpath and deletes the file from splunk ... View more

You can add labelfield To create seperate column labelfield for total |addcoltotals Cost labelfield=Total label="Total Cost" If you want to add "Total" field in other existing Column then add this: | addcoltotals Cost labelfield= Engagement label="Total Cost" Please accept the answer if this helped for future reference!! ... View more

What is the search affinity setting? You can refer this doc: http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Multisitesearchaffinity#Implement_search_affinity ... View more

Heu sonushgh68, You can refer this doc and also this accepted answer in splunk for your reference: http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Forwarding/Typesofforwarders https://answers.splunk.com/answers/317035/indexer-and-heavy-forwarder-in-once.html Let me know if this helps!! ... View more

Hey aniruddhduggal, You can try using eval: | fillnull value=empty "Ports Open" |rename "Ports Open" AS Ports |eval Ports=case(Ports="empty" OR Ports="none","none",'Ports') | where Ports!=none |stats count by Ports Let me know if this helps!! ... View more

Hey nmohammed, I am not sure if this will work: Can you try something like this: index=ver_logs [search index=ver_logs | dedup _time | head 1 | return _time] Let me know if this gives you result of only latest source. ... View more

Hey ikulscar, You can monitor both the rotated or non-rotated file and the crc will check-out the hash events. Refer this link: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Howlogfilerotationishandled Let me know if this helps!! ... View more

Hey lycollicott, Are the conditions for replication factor and search factor met? You can check this in Distributed Management Console. When you were performing the maintenance task was the cluster master also stopped? Master is responsible to make the replicated buckets searchable if one peer is down. Refer this link: https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Whathappenswhenamasternodegoesdown Let me know if this helps!! ... View more

Hey ngm, You can add this parameter to your props.conf to check header CHECK_FOR_HEADER = [true] HEADER_FIELD_LINE_NUMBER = 1 (to specify the line number of the header) You can refer this link: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf Let me know if this helps!! ... View more

Hey nuaraujo, Can you try adding something as TZ_ALIAS in props.conf Refer this link : http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Applytimezoneoffsetstotimestamps Let me know if this helps!! ... View more

Hey tdunphy_, You can add this to your query: index=prd_aws_billing (source="/*2017-09.csv") LinkedAccountId="123456789" ProductName="Amazon Elastic Compute Cloud" user_Engagement="" | stats sum(UnBlendedCost) AS Cost by ResourceId,UsageType,user_Name,user_Engagement |rename ResourceId as "AWS Resource Name" UsageType as "Usage Type" user_Name as "Resource Name" user_Engagement as Engagement | fieldformat Cost="$".tostring(Cost)| eval Cost=round(Cost,2) | addcoltotals Cost label="Total Cost" Let me know if this helps!! ... View more

Hey aqudoos, I think the problem is your data is restored in main index, if you want to add it in particular index your path should be this: C:\Program Files\Splunk\var\lib\splunk\your_index\thaweddb\db_1513910393_1513952434_5 This should work!! For confirmation check index=main your data should be available there. ... View more

Did you restart after this? Also check for any errors in internal logs ... View more

hey abhishekroy2018, You can refer the link below: https://answers.splunk.com/answers/523189/how-to-use-timechart-count-to-return-0-when-value.html Let me know if this helps!! ... View more

Can u try this: index="xxx_prod" environment="p" (ZS-2200150 OR ZS-2200039 OR ZS-2200044 OR ZS-2200045 OR ZS-2200046 OR ZS-2200068 OR yyy-021024 OR ZS-2200054 OR ZS-2200056 OR ZS-2200046 OR ZS-2100018 OR xxx-050001) | eval week=strftime(_time, "%V/%Y") | eval error_text=if(like(error_text,"%%"),"Ohne Bezug dürfen ausschließlich wechselwirkungsrelevante Abgaben gespeichert werden", error_text) | rex field=error_text mode=sed "s/..$//" | rex field=error_text mode=sed "s/(.$//" | rex field=error_code mode=sed "s/xxxx-050003/EMED-021024/g" | eval error_text2 = replace(error_text,",", " ") | eval Fehlermeldung=error_code. " " .error_text2. " - " .environment . " - " . application1 | rex field=_raw "IP: (?[^,]+)" | chart dc(ip2) AS "Unique IP" count(Fehlermeldung) over week by Fehlermeldung | sort Fehlermeldung Let me know if this helps!! ... View more

Hey aqudoos, You can refer the following doc: http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Restorearchiveddata You don't need to change the unique id and you need to restart splunk service after restoring data in thawed path. Let me know if this helps!! ... View more

Hey@Rajkumarkbm , Try using timechart index=* | timechart span=1d sum(Volume) AS Volume sum(Duration) AS Duration. Let me know if this helps!! ... View more

Hey Pryshepa, Yes you can use Splunk Forwarder with free splunk enterprise. But you cannot use clustered environment. Hope this helps!! ... View more

Hi brober27, Do u want to check the count of events with specific condition AS ERROR AND say X together? In that case your query can be something like this: index=* (ERROR AND X) | stats count Let me know if this helps!! ... View more

Hey splunkdivya, You can refer the link below: https://answers.splunk.com/answers/106136/how-to-set-the-default-search-time-in-splunk-6.html http://docs.splunk.com/Documentation/Splunk/latest/Admin/Ui-prefsconf Let me know if this helps!! ... View more