I am not sure if this will work, but you can try this: You can refer this link below : https://answers.splunk.com/answers/378092/how-to-hide-panels-based-on-a-search-condition.html And try condition match. ... View more

Hey nmohammed, Are you trying something like this: index="ver_logs" "ERROR detected" | rex field=source "VerLogs\(?.*?)_" | stats latest(cid) AS cid by host | stats count(cid) AS count values(cid) AS cid by host Let me know if this helps!! ... View more

Hey sathyajith_tekdeliver, Already indexed data cannot be added to new index. However you can re-index the data to the new index. For distributed environment. Create seperate index in indexes.conf in $SPLUNK_HOME$/etc/master-apps/_cluster/local for all indexes you want Sample index format: [linux] homePath = $SPLUNK_DB/linux/db coldPath = $SPLUNK_DB/linux/colddb thawedPath = $SPLUNK_DB/linux/thaweddb From the master, Push the configuration bundle via GUI. Settings>Indexer Clustering>Distribute configuration Bundle. This will create indexes. In inputs.conf on the forwarder add index to which data has to be indexed. Sample: [monitor://] index = linux And restart splunk. If you are trying to re-index data then you need to add crc_salt in inputs.conf Refer this link: http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Indexerclusterinputs Let me know if this helps!!! ... View more

Depending on the request, your search query for the second panel should have filter. Something link dis: index=* request=$clicked_request$ | query. So when in the first panel request is selected , the second panel will run the query with the request filter and will display result for that filter And in ur xml it should just be <panel depends="$clicked_request$"> Assuming request is the only filter and the query after that is common to all panels. ... View more

So in the next panel you have to add filter as $clicked_request$ that should help!! ... View more

Hey krusovoice, You can try this run anywhere query: | makeresults | eval Request="AAA BBB CCC" | makemv Request| mvexpand Request | appendcols [| makeresults | eval ID="1122 3344 5566" | makemv ID| mvexpand ID ] | appendcols [| makeresults | eval Duration="40seconds 50seconds 20seconds" | makemv Duration| mvexpand Duration ] |rex field=Duration "(?P<Dur>\d+)"| eventstats avg(Dur) AS avgDur OR you can add this to your query: |rex field=Duration "(?P\d+)"| eventstats avg(Dur) AS avgDur Let me know if this helps!! ... View more

Hey krusovice, You can refer the following link: https://answers.splunk.com/answers/188709/how-to-display-dashboard-panels-dynamically.html https://socprime.com/en/blog/using-depends-panels-in-splunk-for-creating-convenient-drilldowns/ Let me know if this helps!! ... View more

To convert timezone at search time you don't need access to search head cli, you need to convert it in search time. Refer this link: https://answers.splunk.com/answers/241917/timezone-conversion-function.html https://answers.splunk.com/answers/135380/eval-to-find-current-time-in-another-timezone.html ... View more

Hey shraddhamudulli, To push the app from the deployer you need to move your app first to $SPLUNK_HOME$/etc/shcluster/apps/ and then use the command $ ./splunk apply shcluster-bundle -target https://:8089. Let me know if this helps!! ... View more

hey Bentash, Please accept the answer by elliotproebstel to close the question. ... View more

Hey Said7, This message means your search processes are taking much time to read initial configuration information from disk. What does the I/O subsystem underneath $SPLUNK_HOME/etc look like in your environment? If $SPLUNK_HOME/etc is networked storage, for example, there might be disk/network performance issues affecting search startup time. Let me know if this helps!! ... View more

Hey dave0970, Looks like your eval is not a condition but a message to the end user and you can add it in description whereas for alert to trigger you need condition to be satisfied. Refer this doc below: https://docs.splunk.com/Documentation/Splunk/latest/Alert/AlertTriggerConditions Let me know if this helps!! ... View more

Yes , and you need to add the path in inputs.conf on forwarder to monitor the logs you need to index in splunk. Also you need to enable outputs.conf on forwarder and enable receiving on indexer. You also need to create index in indexes.conf on splunk instance. Refer the link: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Getstartedwithgettingdatain Let me know if this helps!! ... View more

Since the data is not available can you try following options 1. Export raw data for the time period the TZ was wrong and reindex again. 2. Also you can try converting TZ in search time(Needs to be tested) You can refer the link below: https://answers.splunk.com/answers/224134/force-displayed-timezone-in-results-to-be-utc-not-1.html#answer-224136 https://answers.splunk.com/answers/241917/timezone-conversion-function.html ... View more

Hey Skins, You can check following approaches for faster reports: 1. LoadJob: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob 2. You can also use accelerated data models: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels 3. Scheduled Report http://docs.splunk.com/Documentation/Splunk/latest/Report/Schedulereports 4. Summary indexing. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing Let me know if this helps!! ... View more

Hey Barty , Can you try something like dis: index=mail sourcetype=imap cprd latest="03/03/2018:15:00:00" | rex field=_raw max_match=0 "(?<Jobname>(p-c[a-z\-]+)\s*([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})..([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})\s*([SU]{2}|[RU]{2}|[FA]{2}|[IN]{2}))" | mvexpand Jobname | rex field=Jobname "(?<Jobname>(p-c[a-z\-]+))\s*(?<LastRunStartDate>([0-9]{2}\/[0-9]{2}\/[0-9]{4})).(?<LastRunStartTime>([0-9]{2}:[0-9]{2}:[0-9]{2})|-{5})\s*(?<LastRunEndDate>(..([0-9]{2}\/[0-9]{2}\/[0-9]{4}))).(?<LastRunEndTime>([0-9]{2}:[0-9]{2}:[0-9]{2})|-{5})\s*(?<LastStatus>([SU]{2}|[RU]{2}|[FA]{2}|[IN]{2}))" | eval LastRunStartTime=strptime(LastRunStartTime,"%H:%M:%S"),LastRunEndTime=strptime(LastRunEndTime,"%H:%M:%S") | eval RunTime=LastRunEndTime-LastRunStartTime | eval RunTime=strftime(RunTime,"%H:%M:%S") | stats values(RunTime) as Previous_Run by jobname | join Jobname [ index=mail sourcetype=imap cprd latest="07/03/2018:10:00:00" | rex field=_raw max_match=0 "(?<Jobname>(p-c[a-z\-]+)\s*([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})..([0-9]{2}\/[0-9]{2}\/[0-9]{4}).([0-9]{2}:[0-9]{2}:[0-9]{2})\s*([SU]{2}|[RU]{2}|[FA]{2}|[IN]{2}))" | mvexpand Jobname | rex field=Jobname "(?<Jobname>(p-c[a-z\-]+))\s*(?<LastRunStartDate>([0-9]{2}\/[0-9]{2}\/[0-9]{4})).(?<LastRunStartTime>([0-9]{2}:[0-9]{2}:[0-9]{2})|-{5})\s*(?<LastRunEndDate>(..([0-9]{2}\/[0-9]{2}\/[0-9]{4}))).(?<LastRunEndTime>([0-9]{2}:[0-9]{2}:[0-9]{2})|-{5})\s*(?<LastStatus>([SU]{2}|[RU]{2}|[FA]{2}|[IN]{2}))" | eval LastRunStartTime=strptime(LastRunStartTime,"%H:%M:%S"),LastRunEndTime=strptime(LastRunEndTime,"%H:%M:%S") | eval RunTime=LastRunEndTime-LastRunStartTime | eval RunTime=strftime(RunTime,"%H:%M:%S") | stats values(RunTime) as Todays_Run by jobname] | table Jobname Previous_Run Todays_Run | eval Percentage=round((Todays_Run-Previous_Run/Todays_Run)*100) | search Percentage>10 Let me know if this helps!!! ... View more

Hey kundanbisht, You cannot make any changes in TZ once the data is indexed. However you can clean and re-index the data adding crc_salt. This will add TZ in your data which is indexed again. Let me know if this helps!! ... View more

Is there any license error? Also check index=_internal log_level=ERROR for any error messages. ... View more

Hey NDsupport, You can create a custom add-on using addon builder which will be CIM compatible. Reference: https://splunkbase.splunk.com/app/2962/ https://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/Overview Let me know if this helps!! ... View more

Hi, Sorry for the confusion, yes inputs on forwarder. ... View more

Hi, Is the field extraction working fine? You can refer the following doc: https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Transformsconf And use parameter FORMAT Let me know if this helps!! ... View more

Hey AdsicSplunk, You can try this: [source::/opt/saggw101/IntegrationServer/instances/default/logs/server.log*] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true MUST_BREAK_AFTER = (Length)=\d+ Let me know if this helps!! ... View more

Hey rafeeqsid25, You can try using this app: https://splunkbase.splunk.com/app/3817/#/details Let me know if this helps!! ... View more

Hey krusovice, Is your city field already extracted? If yes, then rather than writing eval you can try something like this: index=* | search city=$city$ In this case, if you select all, city will be selected as city=* and that should help!! Let me know if this worked!! ... View more