Hello, do you see any corrupt buckets? Sometimes restarting the CM has been known to clear the bucket fix up stuck tasks in the past. Refer: https://docs.splunk.com/Documentation/Splunk/9.3.1/Indexer/Anomalousbuckets ... View more

I believe you should have something like below, did you already try this? On Your parsing instance [my_sourcetype] SHOULD_LINEMERGE = false LINE_BREAKER = }([\n\r]*){ TRUNCATE = as needed On your Search Head [my_sourcetype] KV_MODE = json     Hope this helps.     ... View more

I believe there is something wrong on your DMC set up. Please only enable Distributed Mode on the monitoring console instead of search head and indexers.  You can also try creating new health check item with some query and see if that works.  /en-US/app/splunk_monitoring_console/monitoringconsole_check_list I would encourage you to open a support case or on ondemand request. ... View more

First Lets find the transforms.conf by running the below btool. opt/splunk/bin/splunk btool transforms list --debug | grep sourcetype_1 Then you can try something like this on your transforms.conf from the above the app? splunk@idx1:/opt/splunk/bin$ /opt/splunk/bin/splunk btool validate-regex /opt/splunk/etc/apps/learned/local/transforms.conf --debug Bad regex value: '-zA-Z0-9_\.]+)=\"?([a-zA-Z0-9_\.:-]+)', of param: transforms.conf / [metrics_field_extraction] / REGEX; why: unmatched closing parenthesis       ... View more

Hello! There could be a regex defined on that sourcetype. Please run a btool on the backend for that sourcetype and figure out if you find any spaces or typos in that regex, then try to remove them. /opt/splunk/bin/splunk btool validate-regex --debug I would check out the search.log instead on whats happening there. Hope this helps. ... View more

I don't see an issue on my lab with the same version.  The only reason I could think of is make sure there are no "unconfigured instances" on your monitoring console. Make sure you set this and apply changes as per this doc. https://docs.splunk.com/Documentation/Splunk/9.3.1/DMC/Configureindistributedmode#Reset_server_roles_after_restart Hope this helps and resolves. ... View more

Thank you for sharing your detailed process and the issue you're encountering with JSON log ingestion. Your testing approach was thorough, but there are a few key points to address: Props.conf location: The primary parsing settings should be on the indexers, not the search heads. For JSON data, you typically only need minimal settings on the search head. Search head settings: On the search head, you can simplify your props.conf to just: [yoursourcetype] KV_MODE = JSON This tells Splunk to parse the JSON at search time, which should give you the field extractions you're looking for. In order to onboard this properly you can also set MAGIC6 props on your indexers. https://community.splunk.com/t5/Getting-Data-In/props-conf/m-p/426134   Try to run the below search to figure out what app is taking precedence.   | rest splunk_server=local /services/configs/conf-props/YOURSOURCEYPE| transpose | search column=eai:acl.app   Please UpVote/Solved if this helps. ... View more

Does it run anything if you select individual category instead of all categories? If its running with fewer categories it could an issue related to load on the DMC to run all categories at once. We had a similar kinda bug in the previous 8.2 versions but not on V9 as I see on my side.       ... View more

Hello! here is the document which explains using inputs. Please expand the code and look out here: https://docs.splunk.com/Documentation/SplunkCloud/9.2.2406/DashStudio/inputs "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, This is the link for Link to a report: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/DashStudio/linkURL#Link_to_a_report If none of these are helping you out, please try creating your dashboard in classic and convert into studio, you might be able to find the difference.  Please UpVote if this helps.   ... View more

Please use this doc to create HEC via CLI: https://docs.splunk.com/Documentation/Splunk/latest/Data/UseHECfromtheCLI Or you can directly create inputs.conf as mentioned here. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-_Local_stanza_for_each_token   Please UpVote if helpful.   ... View more

Yes, You can also use the | loadjob command directly in the search in Dashboard Studio if you're trying to load up saved searches.  I can take a look when I'm on my computer about the issue, please share your json code.    ... View more

Do you have a heavy forwarder in your environment to install this add-on,  this is  a modular input on a heavy forwarder, please disable this on the search head and install this on one of your heavy forwarder.     ... View more

Hello, looks like an issue with app/TA UI visibility. I have seen issues like this whenever there is TA with the missing config. Are you trying to use: https://splunkbase.splunk.com/app/3681 ? is this Splunk Enterprise or Cloud? What Version? Can you please go to Manage Apps > Your app > Edit Properties > Visible  > Just to make sure.     Thanks   ... View more

Go to your cluster master/manager and deploy the app with props.conf from the master-apps.  For example: [my_json] SHOULD_LINE_MERGE = false LINE_BREAKER = (?:,)([\r\n]+)) TIME_FORMAT = %2Y%m%d%H%M%S TRUNCATE = 0 You can edit props.conf in $SPLUNK_HOME/etc/master-apps/_cluster/local/props.conf on master and push cluster-bundle with command 'splunk apply cluster-bundle'. Peers will restart and props.conf, in $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf, will be layered when splunkd start. https://conf.splunk.com/files/2017/slides/pushing-configuration-bundles-in-an-indexer-cluster.pdf   Go to your search head and place the props.conf and restart your search head for the field extractions  [my_json] KV_MODE = json   Remember to be careful if you are updating all these on the production, based on the changes it will require the restart of indexers. please be cautious on the changes.   If you need more hands-on support, we have splunk ondemand services who can guide you through this process and shoulder surf your requirements help you. ... View more

can you please try to use loadjob as mentioned in the document.  <search> <query> | loadjob savedsearch="admin:search:SavedSearch" </query> </search>   ... View more

Thank you for your feedback. We appreciate your engagement and aim to provide the best assistance possible based on the information shared in the community forum. The query provided was our best effort to address your question using the details you offered. Community members, including myself, volunteer our time and knowledge to help fellow Splunk users. If you need more tailored assistance or have specific requirements not covered in the initial query, there are a couple of options: You can provide more detailed information about your data structure and exact requirements in the forum. This would help us refine the solution further. For more in-depth, real-time support where you can share your screen and get personalized guidance, Splunk offers ondemand services. These allow for "shoulder surfing" and can address your specific needs more directly.  Regarding the query itself, you can adapt the latter part to your specific environment as mentioned by @yuanliu  or me.  | stats count as total_servers, count(eval(status_field="YourCompletedStatus")) as completed_count, count(eval(status_field="YourPendingStatus")) as pending_count | eval completed_percentage = round(completed_count / total_servers * 100, 0) | eval pending_percentage = round(pending_count / total_servers * 100, 0) | eval "Completed Servers" = completed_count . " (" . completed_percentage . "%)" | eval "Pending Servers" = pending_count . " (" . pending_percentage . "%)" | fields "Completed Servers", "Pending Servers" Replace index, source, sourcetype, status_field, YourCompletedStatus, and YourPendingStatus with your specific values. This should work with your actual data structure. We're here to help, and we hope this guidance proves useful for your specific use case. Thanks. ... View more

The issue you're experiencing is related to event breaking, not the MAX_EVENTS setting. The warning suggests that Splunk is trying to merge multiple events into a single event, which is exceeding the default limit of 256 lines. Your props should be on the indexers (your parsing instance or HWF), as there are only a very few settings which work on the universal forwarder such as EVENT_BREAKER_ENABLE, EVENT_BREAKER, and indexed extractions. The best way to address this here is to use:     LINE_BREAKER =([\r\n]+)(?:,) SHOULD_LINE_MERGE = False   These settings in your props.conf on the indexer will help ensure that each JSON object is treated as a separate event, preventing the merging that's causing the warning. Additionally, for JSON data like this, you might want to consider using this on the search head only:     KV_MODE = json     This setting helps Splunk interpret the JON structure during search time, making it easier to extract and query specific fields from your JSON data. Please UpVote if this is Helpful. ... View more

looking at the data, you can use something like this. | makeresults | eval servers="Server1,Server2,Server3,Server4,Server5,Server6,Server7,Server8,Server9,Server10" | eval statuses="Completed,Completed,Completed,Completed,Completed,Completed,Pending,Pending,Pending,Pending" | makemv delim="," servers | makemv delim="," statuses | mvexpand servers | mvexpand statuses | stats count as total_servers, count(eval(statuses="Completed")) as completed_count, count(eval(statuses="Pending")) as pending_count | eval completed_percentage = round(completed_count / total_servers * 100, 0) | eval pending_percentage = round(pending_count / total_servers * 100, 0) | eval "Completed Servers" = completed_count . " (" . completed_percentage . "%)" | eval "Pending Servers" = pending_count . " (" . pending_percentage . "%)" | fields "Completed Servers", "Pending Servers"     please upvote if this is helpful. ... View more

Hi! It looks like there's an authentication failure on the Azure side. You need to assign the correct permissions to the Azure app. Before proceeding on configuring https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/ConfigureappinAzureAD ensure your storage account token (SAS) has the following privileges: Use either Access key OR Shared Access Signature with: Allowed services: Blob, Table Allowed resource types: Service, Container, Object Allowed permissions: Read, List Please UpVote if this is helpful.     ... View more

This has been answered here: https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389 You can leverage this search and see if that helps for your monitoring. index=_internal sourcetype=splunkd The number of search artifacts in the dispatch directory is higher than recommended TERM(count=*) | timechart span=1h max(count)     Please upvote if this is helpful. ... View more

Hello! The key point is that Splunk stores all data in UTC, but displays it based on user preferences. This approach allows for flexibility without changing the actual data or dashboard configuration. Here's an example to illustrate: Let's say you have team members in New York (EST) and San Francisco (PST). An event occurs at 2:00 PM PST. The event is stored in Splunk as 10:00 PM UTC. The San Francisco team member (with PST preference) sees it as 2:00 PM. The New York team member (with EST preference) sees it as 5:00 PM. Both are looking at the same data, but it's displayed in their local time. To achieve this: Ensure correct timestamp configuration on data sources. Each user sets their preferred timezone in Splunk settings. This method maintains data consistency while accommodating different timezones without modifying dashboards. Please Upvote if this is Helpful. ... View more

Hello, I understand the situation of managing multiple apps. Personally, I'm not a fan of merging or combining all apps together, as you may end up with merging conflicts and broken apps if not done correctly. This process needs to be handled very carefully. It's not just the Apps directory we need to consider; we should also look into the users directory for private knowledge objects. If your goal is simply to put these apps in a code repository, you can dump the entire apps directory (excluding default apps) and the users directory from the search head and save it. If you believe there is no content in these apps, try to validate and consolidate packages as needed. It's better to start with the UI. Regarding your specific situation with Splunk Enterprise 9.2.1 on Windows and multiple apps: Creating a new app that references dashboards from other apps is possible, but it has some limitations. You can use the <dashboard ref="..."> tag in your new app to reference dashboards from other apps. For example: xml <dashboard ref="/servicesNS/nobody/myapp1/data/ui/views/dashboard1"> </dashboard> This approach allows you to maintain your existing app structure and version control while creating a centralized menu system. However, be aware that this method: Requires careful management of permissions across apps May not work seamlessly with all types of dashboards (especially those with complex dependencies) Could potentially break if the original apps are uninstalled or significantly modified An alternative approach could be to use a navigation app that doesn't actually contain the dashboards but provides links to them in their original locations. This would allow you to maintain your current structure while providing a unified entry point. If you decide to copy dashboards into the new app, consider using symbolic links or a build process in your DevOps cycle to maintain a single source of truth. Remember to thoroughly test any changes in a non-production environment first. Each approach has its pros and cons, so choose the one that best fits your specific needs and infrastructure. please upvote if you find this answer useful   Thanks ... View more

The "Expires" setting doesn't stop your alert from running after 24 hours. Your alert will continue to run daily indefinitely; the expiration only prevents repeated triggering within 24 hours of the last trigger, helping to avoid alert fatigue for ongoing issues.   Hope this helps.  ... View more

I beleive using parameters with ds.savedsearch is not supported. You can use parameters with a regular search using the savedsearch command.   Hope this helps.  ... View more