Thanks for the valuable advertising! I don't need this app in general, but I can use queries from dashboard as examples to resolve my particular case. ... View more

Hello @grep, Can you please try removing whitelisting from the "CIM Setup" page and only have condition available from Macro page? Let me know if it doesn't work and I can troubleshoot. ... View more

Yes. For different input stanzas - sure. But you can't - for example - have multiple apps defining multiple meta entries (like one for the environment the forwarder is in and another for the OS or team responsible or whatever) for the same input. ... View more

Here we go.  So this could be network transmissions so check for firewall blocks and any routing issues first.  Then look into SSL connection issues last. ... View more

Well, rsyslog configuration can be as simple as *.* /var/log/all.log but can also span into several hundreds of files, with complicated processing rules and sending data to multiple destinations and such. Rsyslog recently had a major overhaul of its docs page  https://www.rsyslog.com/doc/v8-stable/index.html (the old docs were a bit confusing at times) and it has a relatively responsive mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog ... View more

That query finds *skipped* searches, not delayed ones.  A delayed search runs late, but still runs, as opposed to a skipped search which does not run at all (at that time). index= _internal sourcetype=scheduler savedsearch_name=* status=deferred | stats count BY savedsearch_name, app, user, reason | sort -count ... View more

Great thanks @dural_yyz I'll try that. ... View more

Did your lookup grow in size during this time?  I had this problem with a large lookup a while ago.  Check out Why does lookup return null when there are multiple matches. ... View more

Thanks, I will work on that information. ... View more

At this point we are getting a bit beyond my personal experiences and now diving into my what if skill set.  The current logging would be out of the box defaults and may not be recording the event that tells you what is happening.  I would look into what debug levels you could increase but I don't know which specifically would help you. Since the machine was offline at run time and having it run when the machine come back on line is an absolute must not happen.  Then I would suggest thinking about reaching out to splunk support. ... View more

Ok, for the first time I don't know which answer should I label as solution XD That because both @isoutamo and @dural_yyz hints helped me to build the final searche. Final result is: | rest splunk_server=local /servicesNS/-/-/configs/conf-savedsearches search="eai:acl.app=<app name here>" | rename "alert.track" as alert_track | eval type=case(alert_track=1, "alert", (isnotnull(actions) AND actions!="") AND (isnotnull(alert_threshold) AND alert_threshold!=""), "alert", (isnotnull(alert_comparator) AND alert_comparator!="") AND (isnotnull(alert_type) AND alert_type!="always"), "alert", true(), "report") | table title, type With this, I can get a table with searches title and its typology, I mean alert or report. Thanks to both! ... View more

I can not tell from the Aruba documentation very easily, but I would hazard a guess from what I do see is this.  The Aruba devices likely forward logs via syslog or HEC, in either case sort out which it is and then follow your Splunk instance current ingestion methods for either of those transport mechanics. ... View more

Start in the DMC to do CPU performance comparison on the various instances or try this search. index=_introspection host=<replace-with-hostname> sourcetype=splunk_resource_usage component=PerProcess "data.pct_cpu"="*" | rename data.* as * | eval processes=process_type.":".process.":".args | timechart span=10s max(pct_cpu) as pct_cpu by processes This is assuming HF, you didn't specify but if it's UF there is something similar just a bit different.  ... View more

Good call on the props, honestly a wild guess is that Month number is somehow inserted as Minute.  Running the dashboard for October would be a good litmus test for that.  But I didn't see anything in the original to make me think that was a real possibility. ... View more

Hi 1st as you are using UDP as transmit protocol you will definitely lost events. You cannot do anything for it as it due to that protocol. You should build separate syslog cluster with VIP address and then send syslog events from those backends to splunk. Both rsyslog and syslog-ng are suitable for that. If you haven't enough experience about syslog server then probably the easiest way to achieve this is use Splunk's SC4S. You could find it from https://splunk.github.io/splunk-connect-for-syslog/main/ https://splunkbase.splunk.com/app/4740 There is also some .conf presentation about it. Probably 2020 (or 2019)? And never use any HF or indexer as terminating TCP/UDP syslog feed with Splunk. Use always separate syslog server. r. Ismo ... View more

Here's what I ended up doing:  Created a dropdown for the versions and added conditions in that to pass to the panels with the queries.  Then I added a row at the top that displays for the user which version to pick from the dropdown.  This wasn't what I had in mind but for now it works.  Below is the dashboard code in case anyone smarter and more experienced happens to notice something I could improve on. <form version="1.1" theme="light"> <label>Education Title Report</label> <search> <query>| inputlookup HealthcareMasterList.csv | search propertyId=$propertyId$ | table propertyId FullHospitalName MarinaVersion | join type=left propertyId [ search sourcetype=sysconfighost-v* earliest=-24@h propertyId=$propertyId$ | dedup propertyId hostId sortby -dateTime | stats max(coreVersion) as coreVersion by propertyId] | eval version=if(isnull(coreVersion),MarinaVersion,coreVersion) | eval version=substr(version,1,2) | eval version=case(version IN ("6.","10","11","12","14"),"Pre15",version IN ("15","16","17","18"),"Post15",1=1,version) | fields - MarinaVersion coreVersion</query> <preview> <eval token="MarinaVersion">$result.version$</eval> </preview> </search> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="propertyId" searchWhenChanged="true"> <label>Site</label> <fieldForLabel>FullHospitalName</fieldForLabel> <fieldForValue>propertyId</fieldForValue> <search> <query>| inputlookup HealthcareMasterList.csv | search ITV=1 AND ITV_INSTALLED&gt;1 | table propertyId FullHospitalName MarinaVersion | join type=left propertyId [ search sourcetype=sysconfighost-v* [| inputlookup HealthcareMasterList.csv | search ITV=1 AND ITV_INSTALLED&gt;1 | fields propertyId | format] | dedup propertyId hostId sortby -dateTime | stats max(coreVersion) as coreVersion by propertyId] | eval version=if(isnull(coreVersion),MarinaVersion,coreVersion) | eval version=substr(version,1,2) | eval version=case(version IN ("6.","10","11","12","14"),"Pre15",version IN ("15","16","17","18"),"Post15",1=1,version) | fields - MarinaVersion coreVersion | sort FullHospitalName</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="WhichVersion"> <label>Marina Version</label> <choice value="Pre15">Pre15</choice> <choice value="Post15">Post15</choice> <choice value="NA">NA</choice> <change> <condition value="Post15"> <unset token="NoAssignments"></unset> <set token="IncludesAssignments">true</set> <unset token="NoInfo"></unset> </condition> <condition value="Pre15"> <set token="NoAssignments">true</set> <unset token="IncludesAssignments"></unset> <unset token="NoInfo"></unset> </condition> <condition value="NA"> <unset token="NoAssignments"></unset> <unset token="IncludesAssignments"></unset> <set token="NoInfo">true</set> </condition> </change> </input> <input type="time" token="field1" searchWhenChanged="true"> <label>Date Picker</label> <default> <earliest>-1mon@mon</earliest> <latest>@mon</latest> </default> </input> </fieldset> <row> <panel> <html>Please select the following for the Marina Version dropdown:</html> </panel> <panel> <html>$MarinaVersion$</html> </panel> </row> ... View more

A second layer of sed script successfully strips the excess whitespace, but it doesn't look like I can include a double quote, even encoded, without Splunk escaping it in the value.  I was really hoping to chain several OR statements into a single lookup value, but I guess that isn't possible. ... View more

Hi, thank you for your reply.  I ran the following query: index=_internal source="*.log" "jsm-splunk-plugin", and here is the result.   Correct me if I ran a wrong query.    Thanks ... View more

That level of JAVA support typically is beyond the Splunk community board.  These answer posts tend to focus on Splunk configurations. ... View more

    HI @ITWhisperer  As you can see in result StartTime is sorted but businedd date is coming as 11/07/2024 in front of that . It is not sorted ... View more

If HP Nimble Storage solution try: https://splunkbase.splunk.com/app/2840 Other wise I don't see any TA's on Splunkbase for HP storage. ... View more

same having this issue when we upgraded to 9.2.3 looks like Splunk installation files installed python 2.7 by default ... View more

It's unlikely but not impossible that your particular setup triggers some bug in the software. What I would do: 1) compare pre- and post-upgrade configs to verify if anything changed 2) do a fresh reinstall of 9.1 where your 9.3 wasn't working and reapply the config 3) If you have the means, try to spin up a fresh indexer with a http input and point that UF to the new indexer. If no obvious reason pops up just raise a case with Splunk support. ... View more