How about something like this to start with? index=_internal sourcetype=splunkd log_level=WARN host=sh* component=DispatchManager "QUEUED" | stats count by host   ... View more

  Hello @Strangertinz  Have you checked this?  https://community.splunk.com/t5/Getting-Data-In/Why-is-Windows-event-log-message-data-being-truncated-and-only/td-p/231310 Do you have any  other issue with your sourcetype? If this is not working, please work with Splunk support, they might ask you generate a diag with DEBUG options to look out for the TRUNCATE message.   If this Helps, Please UpVote. ... View more

@jbanAtSplunk Are you just seeing this errors on internal logs or are you stuck with the upgrade ( you cannot login)? (Thats telemetry information should've fixed in 9.3) Definitely you should reach out to splunk support to get this checked. If this Helps, Please Upvote.     ... View more

Hi @WUShon Have you tried mapping.fieldColors ?  refer:https://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/PanelreferenceforSimplifiedXML. Please check dashboard studio  for more options.        If this Helps, Please Upvote. ... View more

@tbessie Hello, How are you receiving this data UF or HF? Do you have any TIME format settings on your props.conf ? https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuretimestamprecognition#Syntax_overview I would validate Splunk time parsing configurations first. Did you validate if the indexer and the source system might have misaligned clocks, I have seen inaccurate search results with misalignment ?   If this Helps, Please Upvote.   ... View more

Hello @splunksuperman oneshot is typically used in development/testing environments when you want to do below. you can try for loop and wrap the command in it. Upload a file once to Splunk Don't want to set up an ongoing input Need to directly copy data into Splunk Enterprise Refer: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorfilesanddirectoriesusingtheCLI#Monitor_Splunk_Enterprise_files_and_directories_with_the_CLI For your data onboarding consider using a monitored input on a forwarder or use the splunk add-on for Microsoft Windows if dealing with Windows files. If this Helps, Please UpVote ... View more

@verbal_666 May I know the reason you are tryin to update this? Basically replicate search peers is when you want to  add a non-clustered indexer via the GUI, replicate that to your other SHC peers, I don't think that required.        Refer: https://docs.splunk.com/Documentation/Splunk/9.2.0/DistSearch/Connectclustersearchheadstosearchpeers#Replicate_the_search_peers_across_the_cluster   I have only seen  replicate_search_peers is used where you have search head cluster is in use with no index clustering, so if you want to search the non clustered indexers, its set to false.  If you want it to replicate its set to true. replicate_search_peers = true Only works if disabled = false Automatically copies search peer connections to all SHC members Most useful when connecting SHC to non-clustered indexers If this helps., Please Upvote ... View more

Hi @mninansplunk    If you're not sure which index contains your data, start with this search:     | tstats count where source="/var/www/html/PIM/var/log/webservices/*" by sourcetype index host   This is a fast way to find which indexes contain your data and see the associated hosts and sourcetypes. Once you know the right index, you can do a more detailed search:     index=<your_index> source="/var/www/html/PIM/var/log/webservices/*" | stats count by source sourcetype host     For Files & Directories input - was it a typo there? single forward slashes like this?     /HostName/var/www/html/PIM/var/log/webservices/*   make sure file permissions on your input directory and your Splunk forwarder has access to the path Refer: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/GetthetutorialdataintoSplunk https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/GetstartedwithSearch https://www.splunk.com/en_us/blog/customers/splunk-clara-fication-search-best-practices.html If this helps, Please UpVote.   ... View more

Hello @linaaabad! @MuS solution should give you a good start. Please don't use "join" instead use stats .. by as  above. Refer the below for documentation. https://lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Writing_better_queries_in_Splunk_Search_Processing_Language https://conf.splunk.com/watch/conf-online.html?search=PLA1528B#/     ... View more

Below search might be helpful. index=_* AND (SMTP OR sendemail OR email) AND (FAIL* OR ERR* OR TIMEOUT OR CANNOT OR REFUSED OR REJECTED)   Sample errors: ERROR sendemail:. ... ........while sending mail to: If this helps,  please UpVote. ... View more

I think you had the below somewhere in there. You need to get rid of that.   INDEXED_EXTRACTIONS = json     You might be able to find the offending event with something like    index=_internal sourcetype=my_json NOT datetime=*​         ... View more

Hello @Cheng2Ready  The global time range picker cannot be applied to saved searches in Dashboard Studio since each saved search has its own predefined time range. Unlike Classic Dashboards, when you reference a Saved Search in Studio, it will always use its own time range settings, ignoring any global time range selections. For your use case, I recommend: Schedule a report with your required metrics Use the '|collect' command to store results in a new index Create a new role for third-party access that only has permissions for this new index Optionally, you can: Disable specific capabilities for this role Restrict access to only the required dashboard This approach helps maintain security by avoiding direct access to the original index. If this reply helps you. Please UpVote. ... View more

@iamchris as far as I know, there is nothing available yet, but its in the roadmap. (subject to change) Please refer: https://ideas.splunk.com/ideas/EID-I-1913 there is this app, that might help: https://splunkbase.splunk.com/app/6859 or https://splunkbase.com/app/4342/#/details Cheers! If you find this helpful,  Please UpVote. ... View more

@yuanliu can you try clicking inspect on the magnifying glass and see  if that might help? If thats the case looks like a new bug to me. <button data-test="open-search-button" type="button" data-disabled="false" data-clickable="true"   ... View more

Hello @FPERVIL  looks like there its not listening on 9997, may be in issue during the start up of EP. Did you already deploy a pipeline? Have you tried to check edge.log to verify if there are specific errors.?       ... View more

Hello @rrovers Did you already try "display" layout options ? https://docs.splunk.com/Documentation/Splunk/9.3.1/DashStudio/layoutConfigOptions For font sizes:  https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/DashStudio/chartsTable   Hope this helps. ... View more

I found this old bug "SPL-109918"  combined with a different issue though.  Thanks.       ... View more

I think its a permission issue, Google Workspace user should have a “Organization Administrator” role. That’s the only requirement for the account. you account might be read only? ... View more

Hello @isoutamo missing double quotes parsing failing? looks like a bug to me. We had an old similar type bug sometime back on Splunk version6 . ... View more

Hello @yuanliu . I noticed an issue when I cloned my classic dashboards to Studio. Is this happening with brand new dashboards created in Studio? My 9.2.2 (Cloud) version has been verified to have the same issue when cloning from Classic to Studio. However, there are no issues with the original Studio dashboards.   ... View more

I believe this feature is for UF only, code changes are made only for UF. ... View more