Hey@mibrahim8, Please refer this link below: http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex Let me know if this helps!! ... View more

Please accept your answer to close this question 🙂 ... View more

Hey@jiaqya, Refer this doc for detailed explanation: https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/BubbleChart Let me know if this helps!! ... View more

@roysoman, Your inputs.conf shows index=main, change it to index=newindex and restart service. Let me know if this helps!! ... View more

yes!! You need add-on only on one server. ... View more

In that case you can configure add-on on heavy forwarder and forward data to indexer and aws-app on search head. ... View more

Hey@johnchen0213, Refer this link: http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/UsetheHTTPEventCollector Let me know if this helps!! ... View more

Hey@ksasaki0214, Try referring this link: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest Let me know if this helps!! ... View more

Hey@sreerajms, You can add both, the app and add-on on the search head and configure the search head to forward logs to indexer. https://docs.splunk.com/Documentation/Splunk/7.0.3/DistSearch/Forwardsearchheaddata There is no need for heavy forwarder. Let me know if this helps!! ... View more

Hey@jithairu, Refer this accepted answer: https://answers.splunk.com/answers/289251/how-to-change-the-ownership-of-dashboards-to-a-spe.html https://answers.splunk.com/answers/543138/change-ownership-of-alertsearchesdashboard-if-some.html Let me know if this helps!! ... View more

Hey@rajim, For the second point splunk will take care by itself. Refer this link: http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Monitorfilesanddirectories For the first point if you want the 17th line to be your header than add following to your props: HEADER_FIELD_LINE_NUMBER = 17 CHECK_FOR_HEADER=true Let me know if this helps!! ... View more

Hey taha13, I think the problem here is the token values for span field. The span should be in format span=1d OR span=1h and so on. Refer this link: http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Timechart Let me know if this helps!! ... View more

@wanip, Sorry for the confusion, Now i get your question. I am not sure whether there is workaround for this. Lets see if any fellow splunkers have some answer for your problem:) ... View more

Hey@siva_cg You can already find the trend of license usage by index on the license master for 30 days in the usage report. Is there any specific reason to use summary index? ... View more

Hey@chvenu17, Try referring this answer : https://answers.splunk.com/answers/227198/use-rangemap-to-change-color-of-whole-panel.html let me know if this helps!! ... View more

Hey@wanip, You can try using this app: https://splunkbase.splunk.com/app/2627/ Also i am not sure if this will work but you can try this: index=_internal sourcetype=splunkd_ui_access method=post edit ui/views | rex field=other "\s*?-\s*(?[\S]+)\s*" | table user, useragent, req_time, file, sessionId | rename file as dashboard req_time as editTime Let me know if this helps!! ... View more

Hey@nyree2 Was there some activity carried out for this to happen? Upgrade or something? ... View more

Hey@Durbina00, At search time changes you can refer this accepted answer: https://answers.splunk.com/answers/42814/decimal-how-to-use-vs.html Let me know if this helps!! ... View more

Hey@jeffbat, In HTML and JS, you can reference this as such: var element2 = new ChartElement({ "id": "element2", "resizable": true, "refresh.auto.interval": "30", "managerid": "search2", "el": $('#element2') }, {tokens: true}).render(); In Simple XML, you can reference this as such: <panel> <chart> <title>Enable auto refresh of 30s</title> <searchString>index=_internal | top limit=3 sourcetype</searchString> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> <option name="refresh.auto.interval">30</option> </chart> </panel> Let me know if this helps!! ... View more

Hey@jcvytla, Can you try something like this: index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" |table user search maxtime timestamp And later you may add timechart as per your requirement. Let me know if this helps!! ... View more

Hey@ranjitbrhm1, You can refer this doc for visualisations available in Splunk: http://docs.splunk.com/Documentation/Splunk/7.0.3/Viz/Visualizationreference Also some custom visualisation: http://dev.splunk.com/view/dev-guide/SP-CAAAE3C Let me know if this helps!! ... View more

Hey@hirt_lab, Splunk stores data in the form of buckets.You can directly move these buckets from one environment to another. Refer these links: http://wiki.splunk.com/Community:MoveIndexes http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex Let me know if this helps!! ... View more

Hey@matstap, Refer this link: http://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing Let me know if this helps!! ... View more