I don't understand, you just "restart" the machine and lose all the local confs? Check with the support, maybe try another version. ... View more

Can you send the output.conf and the input.conf? ... View more

Do you have any automation or maybe setting the default/local config? ... View more

The answer above works for me. ... View more

try with syslog, check the https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/ProtocolDetection ... View more

you can edit your css, like: .facets-container .viz-facet { height: 80px !important; width: 80px !important; float: left; padding: 15px 0px 0px 0px; } ... View more

try https://docs.splunk.com/Documentation/Splunk/7.1.1/Installation/UpgradeonWindows ... View more

Yes, is fully compatible. ... View more

I agree with the somesoni answer ... View more

Once I try this: https://answers.splunk.com/answers/344864/how-to-properly-add-an-event-listener-for-mouseove.html Maybe you could try? ... View more

Hi Wang, is really easy to create tokens with drilldown. But you need to edit the source with xml, Example: <chart> <search> <query>YOUR SEARCH</query> </search> <option name="charting.chart">column</option> <option name="charting.fieldColors">{"FATAL":0x006400, "WARN":0xD2691E, "INFO":0x228B22}</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.axisY.scale">log</option> <drilldown> <set token="token_click">$click.value$</set> <set token="token_name">$click.name$</set> <set token="token_result_value">$row.<name of label>$</set> </drilldown> </chart> The focus here is the tag drilldown. You can use value, value2, name, name2 and row.the_name_of_the_value can you give a example on what information do you wanna create a token? ... View more

create your own app, and save all those alerts. just tar.gz the app folder and you can install from the file in other splunk, if you cant access the file, install a free version of splunk in your local machine and create those alerts. ... View more

Once I have a similar problem with metadata, then I use Nginx to control the redirections. ... View more

First, check if you have those capabilities, Second, use this app https://splunkbase.splunk.com/app/2878/ Third and last, use WebHook on your slack. ... View more

The UF(light forwarder) can't use props.conf, you need to use with a Heavy Forwarder ... View more

As DalJeanis answer, you can use stats avg(deltatime) and stdev(deltatime) by userId. ... View more

I don't get it, with the above, all you do is counting every index that 'summarize' is false? What I would do is something like: index=* | dedup index | table index Can you give other example or something? What is the name of that column? ... View more

Once I have the same problem, is like the UF cant send to a peer, so he just stops, since he cant send the data, I use load balancing with cluster environment. Check this docs: https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Setuploadbalancingd ... View more

Can you please send more details? Any example of those tables? ... View more

I was having almost the same problem, after several attempts, the only working solution to me was updating my centos5 to centos7 and bam... no more Errors with the JMX. ... View more

No, the universal forwarder is like a light server, you splunk server can forwarder and analise on his own. ... View more

can you post some evnt from the log? ... View more

nice, happy splunking ... View more

i know it sounds dumb, but did you restart your forwarder? It appears as active with this command? ./splunk list forward-server ... View more