Internet Explorer 11 (Splunk Enterprise does not support this browser in Compatibility Mode.) http://docs.splunk.com/Documentation/Splunk/6.6.2/Installation/Systemrequirements ... View more

Hey@Nadhiyaa, This seems to be a connectivity issue. Can you check if you are able to connect to the source server.Also check if splunk forwarder has permissions to read the files. Let me know if this helps!! ... View more

Hey@architkhanna, What version of splunk are you using? The latest splunk doc says the following: Support for Internet Explorer versions 9 and 10 has been removed (Originally introduced in version 6.5) Microsoft has announced that support for all versions of Internet Explorer below version 11 has ended as of January 12, 2016. Owing to that announcement, Splunk has ended support for Splunk Web for these same versions. This might result in a suboptimal browsing experience in earlier versions of Internet Explorer. When you upgrade, also upgrade the version of Internet Explorer that you use to 11 or later. An alternative is to use another browser that Splunk supports. http://docs.splunk.com/Documentation/Splunk/7.1.2/Installation/AboutupgradingREADTHISFIRST Let me know if this helps!! ... View more

Hey Nadhiyaa, Go through this answer: https://answers.splunk.com/answers/587431/anyone-have-luck-ingesting-influxdb-into-splunk-db.html May be this will help!! ... View more

Hey@smstoyanov, You can try using this app: https://splunkbase.splunk.com/app/3723/ Let me know if this helps!! ... View more

Hey@ratulbose, You can refer some suggestions from this answer: https://answers.splunk.com/answers/373532/why-am-i-getting-error-splunk-enterprise-setup-wiz-3.html Let me know if this helps!! ... View more

Hey@anandhalagarasan, What version of splunk are you using? ... View more

Hey@agneticdk, What is the replication factor and search factor that you are using ? The doc says "To achieve primary rebalancing, the master reassigns the primary state from existing bucket copies to searchable copies of the same buckets on other peers" for this condition you need to have searchable copies on other indexer. Can you check this? ... View more

Hey@a212830, What version of Splunk are you using? Can you check if you are facing similar problem: https://answers.splunk.com/answers/654411/splunk-710-upgrade-of-free-version-finalizes-searc.html?childToView=678787#answer-678787 Let me know if this helps!!! ... View more

Hey@dijikul, You can try using KV_MODE=json in your props.conf which will enable search time extraction. KV_MODE = [none|auto|auto_escaped|multi|json|xml] * Used for search-time field extractions only. * Specifies the field/value extraction mode for the data. * Set KV_MODE to one of the following: * none: if you want no field/value extraction to take place. * auto: extracts field/value pairs separated by equal signs. * auto_escaped: extracts fields/value pairs separated by equal signs and honors \" and \ as escaped sequences within quoted values, e.g field="value with \"nested\" quotes" * multi: invokes the multikv search command to expand a tabular event into multiple events. * xml : automatically extracts fields from XML data. * json: automatically extracts fields from JSON data. * Setting to 'none' can ensure that one or more user-created regexes are not overridden by automatic field/value extraction for a particular host, source, or source type, and also increases search performance. * Defaults to auto. * The 'xml' and 'json' modes will not extract any fields when used on data that isn't of the correct format (JSON or XML). Let me know if this helps!! ... View more

hey@andrehl, You can try something like this: index=_internal |stats count by sourcetype | eventstats sum(count) AS Total | eval percent=round(count/Total*100,2) | fields - Total count If you want to display both count and percentage than you can use chart overlay. Let me know if this helps!! ... View more

You can try doing du -ch after going to the path opt/splunk/var/lib/splunk . This will give you exact split of what index is taking how much storage and you can further check in which datamodel is taking what storage. May be this would help!! ... View more

Hey@sjcoluccio67, You can refer this blog: https://www.splunk.com/blog/2016/03/15/splunking-microsoft-azure-data.html Also you can use this app: https://splunkbase.splunk.com/app/3040/ Let me know if this helps!! ... View more

Hey@atyshke1, I think the issue is with the path of the script .Instead of .\ it should be $SPLUNK_HOME or the splunk home path. Refer this link: https://docs.splunk.com/Documentation/Splunk/7.1.2/AdvancedDev/ScriptSetup Let me know if this helps!! ... View more

Hey@mwibowo1, Can you try this: rex field=_raw "\"ContactId\":\"(?P.*)\"" Let me know if this helps!! ... View more

Hey@tlmayes, Where are you running df -h exactly? Also does your splunk setup have datamodel accelerated? Can you check if the 60GB is the volume used by datamodel? ... View more

Hey@karthi2809, You can try using field extractor and use | as delimiter and rename your fields extracted. https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/ExtractfieldsinteractivelywithIFX Let me know if this helps!!! ... View more

Hey@jip31, You can add these attributes in your props.conf: https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Propsconf TIME_FORMAT = TIME_PREFIX = Let me know if this helps!! ... View more

Hey@Uday_Gonti, You can try running this: sourcetype=abcd field2="abc" OR field3="xyz" OR field4="vbg" Let me know if this helps!! ... View more

Hey@patricianaguit, You can refer this link for better understanding: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata Let me know if this helps!!! ... View more

Hey@splunker969, You can try using metrics.log for various parameters. Eg: index=_internal source=*metrics.log group=search_concurrency "system total" OR you can also use audit logs. Let me know if this helps!! ... View more

Hey Allampally, You can try using this: untable requests_per_sec _time | xyseries _time requests_per_sec Or refer this link: https://answers.splunk.com/answers/1286/is-there-a-way-to-get-a-result-that-looks-like-timechart-but-with-the-axes-reversed.html Let me know if this helps!! ... View more

Hey@psenger, You can refer this link: http://dev.splunk.com/view/java-sdk/SP-CAAAEXF Let me know if this helps!! ... View more

Hey@ppuru, Not sure if this helps but you could refer this link: https://answers.splunk.com/answers/476827/where-does-the-splunk-add-on-for-box-store-checkpo.html https://answers.splunk.com/answers/11948/winsock-error-10054.html Let me know if this helps!! ... View more

Hey@rayleadingham, You can try this: index=index | table FieldA FieldB | where FieldB="00.000" Let me know if this helps!! ... View more