Not sure what is happening with your log in attempts but in reality I highly recommend you do not enable WebGUI on any indexer.  The cluster should only be managed by the CM since with the WebGUI the ability for configurations to get out of sync is a very high risk. ... View more

I find this very confusing, like you have overlapped two seperate issues. ... View more

Someone mentioned in a previous post if a null value is present as an answer then it can mess with the viz. ... View more

<deleted my own answer> ... View more

Actually most of your problem is coming from multiple capture groups inside a capture group designated by each "()" pairing.   | makeresults format=csv data="sample 600 reason and more:then what 701 code practice Reason 899 something 104 this 12 nothing" | rex field=sample "^(?<Metric>[^\s]+)\s(?<Reason>[^:|^R]+).*$" | table sample Metric Reason   You can see in my example that after the <field> I did not nest additional capture group designations such as what you were using.  The above generates some random data which I hope fits your use case but you provided minimal examples so I made assumptions.  The rex as coded would with draw the information you are looking for assuming that the Metric is the first one the line or field and following that is the Reason with your indicated cut off characters or end of line like I indicated.  Feel free to remove the indicators for beginning of line and end of line if they don't fit your data. Here is the output I get. sample Metric Reason 600 reason and more:then what 600 reason and more 701 code practice Reason 701 code practice 899 something 899 something 104 this 104 this 12 nothing 12 nothing   ... View more

Missing data makes me immediately think of two things and one is much easier to find and fix. 1) Bad time ingestions index=_introspection | eval latency=abs(_indextime-_time) | table _time _indextime latency | sort - latency | head 15 Try sorting both - (descending) and + (increasing), this will help point out anything that is ingesting with bad time formatting causing the data to appear as missing. 2) Skipping events You would need to dig through your HF internal logging to check for full queues or max transmit violations.     Give that a start. ... View more

Compare the contents of the "splunk/etc/apps/splunk-rolling-upgrade" against the manifest file.  Some previous files may be left behind after the upgrade and triggering the python 2 warning.  If any have the same name you may need to manually copy from the v9 Splunk extracted to a safe location. ... View more

Your license measures breaks down by index for daily usage.  Just check the DMC for the reports. ... View more

I've not done the cloud enough to know if this works, but on prem I would have done this. | rest splunk_server=local /servicesNS/-/-/configs/conf-limits search="eai:acl.app=*" ... View more

Any chance you can accept something as simple as converting the crt to pem and appending to existing pem file? ... View more

My background is network engineering so I can't speak to any specific software processing benefits of HTTP vs HTTPS.  However, since HTTP is essentially plain text that would be fairly simple to take the packet off the wire.  Having to decrypt HTTPS would by the very nature of an additional step add processing requirements but as pointed out by others depending upon the compute power of your server(s) there usually isn't a noticeable hit or queuing of data.  Most systems today have compute that will outperform the physical network connection. ... View more

If you have a search head cluster on prem try electing a new captain to force push a new SHC bundle. If that doesn't work then more information would be required about how user and roles are working and if you have any thing has changed there.  Is there anything via auth .conf doesn't show up anymore. ... View more

Please don't every disable SSL for HTTP Event Collection - this is purely from a security stand point.  If you absolutely must have an HTTP only connection please setup a separate HF for this purpose.  Never expose your indexing tier to non-SSL connections. ... View more

https://docs.splunk.com/Documentation/Splunk/9.3.0/Admin/Outputsconf There are many options available in the outputs.conf.spec sheet.  You can start setting queue and buffers but be cautious that data in queues and buffers can age out and risk no ingestion. The other thing is try setting compression to reduce the network traffic demands but it will increase the CPU demands on source and destination so make sure that you have cycles to spare. ... View more

Splunk audit logs will pick the src ip for the log from the incoming packet.  To me this indicates your LB is doing full blow SNAT rather than maintaining the source IP on the 'inside' portion of the connection.  This would be an issue for your network/LB admin team to resolve if possible based on their network design. This is not something that Splunk administration/configuration can fix. ... View more

https://docs.splunk.com/Documentation/Splunk/9.3.1/DashStudio/inputConfig#Manually_refresh_dashboards_with_a_submit_button ... View more

https://community.splunk.com/t5/Getting-Data-In/Adding-a-field-and-changing-source-from-Source/m-p/147386 https://community.splunk.com/t5/Getting-Data-In/How-to-replace-meta-information/m-p/98452 Here are 2 links demonstrating different use cases to replace source values with something for their particular use.  Leveraging rex you can replace your source with the value and match you require.  The process is the same even if the rex is different. ... View more

Depends on what your SMS provider provides as API hooks.  It's well documented that you can use a Splunk Alert to interact with API's but that needs to be provided by the far end or something you manually create yourself. ... View more

Ugly and stupid but I've seen this before and didn't find a nice answer. Try this... 'initial search spl' | fields * 'remainder of search as written' ... View more

https://www.splunk.com/en_us/blog/platform/splunking-your-conf-files-how-to-audit-configuration-changes-like-a-boss.html?locale=en_us This will show you how to track conf file changes.  Earlier questions wanted to change control on dashboards which are xml files so it wont work for those. ... View more

    | makeresults format=csv data="bit1,bit2 0000,0002 000f,0088 00af,00de 00bd,003c" | fields bit1 bit2 | eval bit1ASnumber=tonumber(bit1,16), bit2ASnumber=tonumber(bit2,16) | eval bit1ASbinary=tostring(bit1ASnumber,"binary"), bit2ASbinary=tostring(bit2ASnumber,"binary") | table bit1 bit2 bit*ASnum* bit*ASbin*     bit1 bit2 bit1ASnumber bit2ASnumber bit1ASbinary bit2ASbinary 0000 0002 0 2 0 10 000f 0088 15 136 1111 10001000 00af 00de 175 222 10101111 11011110 00bd 003c 189 60 10111101 111100 Ok I can get you as far as converting to binary but the results of the binary do not include leading 0's to always make an 8 character string/number.  Since your example had 4 characters for the hex code those values are treated as string so first convert to a number before converting to binary as attempting to go straight will fail when your source as a mix of alphanumeric characters. Obviously without the leading zeros when you concatenate the two values as strings you will lose some positions you need to count.  Also I didn't bother with sorting out the count how many zero's right of the last occurring 1 but essentially that's what comes after inserting your leading zero's ... View more