Hey@davebo1896, Have you created this stanza in inputs.conf? [<input_stanza_name>] account = <value> subscription_id = <value> start_time = <value> index = <value> interval = <value> is the interval parameter added? Refer this doc: http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs2 Let me know if this helps!! ... View more

Hey rajakbdual, Can u try something like this: index=sales sourcetype=csv source=sales_new.csv date_month=december | timechart span=1w Sales Let me know if this helps!! ... View more

Hey@usha_nittala, Yes you can filter events before indexing. Refer the link below: http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad Let me know if this helps!! ... View more

Hey rajakabdual, Can u try the following query: index=sales sourcetype=csv source= sales_new.csv earliest=-1mon@mon | timechart span=1d count Let me know if this helps!! ... View more

Hey@mjlsnombrado, You need to install add-on for Vmware. https://splunkbase.splunk.com/app/3215/#/details You can refer this doc to check which paths are monitored by add-on: http://docs.splunk.com/Documentation/AddOns/released/VMW/vCenterlogs Let me know if this helps!! ... View more

Hey@rajkiran8992, What version of Splunk and Modular Input App are you using? ... View more

Hi Kwip, Can you try this: index=XXX sourcetype=yyyy status=* job=* | lookup dummy.csv job OUTPUT Category | stats latest(status) as CurrentStatus values(StartTime) values(EndTime) values(Category) AS Category by job ... View more

Hey@Kwip, Can you try something like this: index=XXX sourcetype=yyyy status=* job=* | lookup dummy.csv job OUTPUT Category | search Category="*" | stats latest(status) as CurrentStatus values(StartTime) values(EndTime) by Category,job Let me know if this helps!! ... View more

You can refer this link: https://www.splunk.com/en_us/training.html ... View more

Hey@dpatil3, You can refer this link for Splunk installation on lInux: http://docs.splunk.com/Documentation/Splunk/7.0.3/Installation/InstallonLinux Let me know if this helps!! ... View more

Hey@sai_john, Can you try something like this index="_internal" "login" earliest=-30d|search id="" |stats dc(id) AS "Total_Login" by date_hour, date_wday|chart avg(Total_Login) AS AverageLogins over date_hour by date_wday limit=0 | table date_hour AverageLogins |join date_hour [search index="_internal" "login" earliest=-24h |search id="" | stats dc(id) AS "TodayLogins" by date_hour, date_wday |chart values(TodayLogins) AS TodayLogins by date_hour limit=0 |table date_hour TodayLogins] |eval Diff=(TodayLogins-AverageLogins) | table date_hour TodayLogins AverageLogins Diff Let me know if this helps!! ... View more

Hey@kpavan, You can refer this doc for reference: https://wiki.splunk.com/Deploy:Migrating_a_Splunk_Install Let me know if this helps!! ... View more

Hey@frank_buettner, You need to contact Splunk support for this scenario. Let me know if this helps!! ... View more

is the datamodel accelerated? ... View more

Hey@rashid47010, There are certain limitation for trial license such as clustering and all cannot be done. Refer this doc for limitations: http://docs.splunk.com/Documentation/Splunk/7.0.3/Admin/MoreaboutSplunkFree Let me know if this helps!!! ... View more

Hey@aqudoos, Are the internal logs of the forwarder also delayed? ... View more

Hey@cfc_logs, I think you need to contact Splunk Support for this issue. Similar issue has been faced by someone recently: https://answers.splunk.com/answers/638479/in-cloud-addition-why-is-there-an-error-when-insta.html https://answers.splunk.com/answers/569087/splunk-add-on-for-amazon-web-services-on-splunk-cl.html ... View more

Hey@mjlsnombrado, You can use btool command to check configuration files that are being used. You can refer these documents for further reference: http://docs.splunk.com/Documentation/Splunk/7.0.3/Troubleshooting/Usebtooltotroubleshootconfigurations http://docs.splunk.com/Documentation/Splunk/7.0.3/Troubleshooting/IntrototroubleshootingSplunk Let me know if this helps!! ... View more

I have edited my answer... can u try now? ... View more

Hey@leo_systex, You can use something such as load job and run your search based on the result of load job. Refer this link: https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Loadjob Let me know if this helps!! ... View more

@acharlieh Agreed 🙂 ... View more

@bullcitydave, May be try reducing the interval,Since its 7200 the data will be available after 2hrs. Try reducing interval for testing and once confirmed set back to normal. ... View more