Hey@nemaden, Any reason to use date_hour and date_minute ? Instead use _time. date_hour field will give you values for all 24 hrs for any date that comes in the log.I assume this is your problem. Please try and report if this helps!! ... View more

Hey@rashard, The learn more tab has documentation added to it .Please refer the document. I think the problem is with the syntax of the input name.Try adding _ instead of -. Also this is the troubleshooting manual for reference: http://docs.splunk.com/Documentation/AddOns/released/AWS/Troubleshooting#Problem_saving_during_account_or_input_configuration Let me know if this helps!! ... View more

Hey jw44250, Try using this: | rex field=_raw "serialNumber\"\:\"(?P<SerialNumber>[^\"]+)\"" Let me know if this helps!! ... View more

Hey@hitenv79, Yes Splunk can handle these logs. But it would be better if the path for logs is fixed.Else you need to write monitor stanza for all predictable paths which can be tedious. Also the name format should not be same as some other files, since the path is not fixed else you might risk of indexing unwanted data. Also refer this doc: http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Monitorfilesanddirectories Let me know if this helps!! ... View more

Hey@kiamco, For source=summary_daily_users You have splitted it by _time.This will give you hourly count of distinct users,since the summary index used earlier is hourly basis. You can try running your query like this: index=summary source="summary_users" | eval today=relative_time(now(),"@d") |eval time=strftime(today,"%d/%m/%Y %H:%M:%S") |stats dc(user_id) as user_id dc(named_user_id) as named_user_id dc(anon_user_id) as anon_user_id by time, ms_region, tenant_id, browser |collect index=summary source=summary_daily_users |sort -num(time) Let me know if this helps!! ... View more

Hey daniel333, Is there any particular reason to this? You can disable internal indexes for specific roles. You can refer this doc: https://docs.splunk.com/Documentation/Splunk/7.0.3/Security/Aboutusersandroles Let me know if this helps!! ... View more

Hey@nawazns5038, Adding empty stanza in search head shouldn't cause a conflict as there are parameters that go in search head as well. But the configurations should be added on the indexers. Please refer this doc for details: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F Let me know if this helps!! ... View more

Hi @pcsegal, Please refer the following link: http://docs.splunk.com/Documentation/Splunk/7.0.3/Capacity/Accommodatemanysimultaneoussearches#How_to_maximize_search_performance http://docs.splunk.com/Documentation/Splunk/7.0.3/Capacity/Referencehardware Does your instance have the specifications recommended? Let me know if this helps!! ... View more

Hey@priyanka0309, You can refer this doc: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_tokens_for_conditional_operations_with_the_.3Cdrilldown.3E_element. Just pass in the click.value2and the earliest/latest and I think it would work. Let me know if this helps!! ... View more

Hey @javiergn, Can you try using this query: | tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count" from datamodel=Application_State.All_Application_State where nodename=All_Application_State.Ports AND All_Application_State.Ports.transport_dest_port < "1025" by "All_Application_State.dest" | rename "All_Application_State.dest" as "dest" | where 'port_count'>20 Let me know if this helps!! ... View more

Hey@David16, You can refer this doc: http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Setadefaulthostforaninput Let me know if this helps!! ... View more

Hey@ctaf, Are you trying to filter events and take data only for particular events?Then refer this link: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest Also refer this link for hostname: http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Setadefaulthostforaninput Let me know if this helps!! ... View more

Hey@kpsajin, You can refer this app: https://splunkbase.splunk.com/app/847/ Let me know if this helps!! ... View more

Hey@raomu, Your inputs mention sourcetype as cisco_ips_syslog. And you are checking sourcetype=sdee_connection Can you check sourcetype=cisco_ips_syslog. Let me know if this helps!! ... View more

Hey tsawa, Refer these documentation below: https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Usepersistentqueues http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Setlimitsondiskusage http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/HowSplunkstoresindexes Let me know if this helps!! ... View more

Hey @ JarettM, Did you refer this manual to configure inputs: http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/ConfigureUDPinputs http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Configureinputs Let me know if this helps!! ... View more

Hey@johnward4, You can refer this add-on: https://splunkbase.splunk.com/app/3776/#/details Let me know if this helps!! ... View more

Hey@Ghanayem1974, Can you share the sample format of the logs and what exactly you want to extract? ... View more

@pcsegal, Can you share the query that you are running? ... View more

Hey@saibal6, Please refer this doc : http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest Let me know if this helps!! ... View more

Hey@Venkat_16, You can try adding this parameter in props.conf TRUNCATE = 0 Let me know if this helps!! ... View more

Hey@Riossr, You can try this run anywhere command: | makeresults count=3 |eval duration=60| eval dateadded_epoch = strftime('_time',"%Y-%m-%d %H:%M:%S")|eval date_epoch = strptime('dateadded_epoch',"%Y-%m-%d %H:%M:%S") |eval date=date_epoch+duration | eval date1 = strftime('date', "%Y-%m-%d %H:%M:%S") You need to convert your Time_A to epoch and then add Time_C and then again convert to date. That will help you use it in readable format Let me know if this helps!! ... View more

You can move the buckets in the specific index to one of the indexers in cluster in the same index path . Make sure the indexer in cluster is stopped before moving this data and once the indexer is started the data will be searchable and also the replication will be taken care-of. ... View more