Would be beneficial posting a sample of the search you're using. This will usually happen in two cases: 1. No data is available (perhaps no new data was indexed since it last worked or even the retention of the data you're looking for already deleted the old data) 2. The field transformations you were using were changed and you cannot filter anymore the data (in this case I recommend you start cutting the search query you were using to make sure you're matching something, let's say for example you were using this search: index=abc sourcetype=abc event=filtered | start count by host , you can search for only index=abc that should give you an idea if you really have data there and the problem is not your query ... View more

Depending what you want to display on your dashboard you might be looking for subsearches (as you're doing above) or post process searches/base searches. If you want to display let's say value 1 and value2 and then the percentage, all on separate panels, there are some ideas here: https://answers.splunk.com/answers/239159/multiple-base-searches-in-a-dasboard-with-post-pro.html and https://answers.splunk.com/answers/461853/how-to-use-multiple-base-searches-in-one-search.html. Also, more information about post-process searches can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/Savedsearches#Post-process_searches_2 ... View more

Are you talking about the original sourcetype of the event that created the notable? If yes, you'll need to change your Correlation Searches to generate a field that might be called origin_sourcetype so you can later use it. I don't think you have many other options other than that. ... View more

I believe I had a similar problem in the past and it was due to permissions on Solaris. It had permission to read the file but for some reason not able to read it. May I suggest you temporarily change permissions? E.g. change owner to user running Splunk and change permissions to 744 (or even 777 temporary)? Also can you post the results from splunk cmd btool inputs list ? Also what messages does splunkd.log show you on the log that should be getting monitored? ... View more

If you correctly configured the search head it will only visualise data (i.e. you configured the SH to forward data to the indexer(s)). Indexer(s) is the place where you should be aiming to keep the data. You check the retention configuration on the same way on the Indexer as on the Search Head. The monitoring console can help you visualise the configuration. Index configuration is done on indexes.conf ... View more

What status does it show on the jobs window? It might be the case there are so many searches that it got queued. ... View more

Might be worth checking the UF inputs configuration from the btool command: splunk cmd btool inputs list ... View more

Hi, I believe you can use the command transaction to achieve that. Using transaction you need to define the boundaries of an event (with startswith and endswith) and it will give you both the number of events in each transaction and how much time between the event start and the end of the event. More information on that command can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Transaction ... View more

It seems you're not reaching the server. Use the address that you're accessing. I recommend you get someone to help you with the connectivity, use tcpdump to see if the traffic is reaching the server etc ... View more

Where are you trying to access that? From your computer? You seem to have a Linux server with Splunk installed. How do you access this server? SSH? Probably a bit easier if you install on your local computer xD ... View more

This means it is connected. Now try on your browser: http://splunkhl04:8000 ... View more

You can choose to send the inline table results of your search, that will show every line of the alert. ... View more

You can setup an app as default so a user will get it when it is opened. And the only way to get a dashboard when a user login is to define it as the default view on your app. With that in mind, another way is to click on the dashboard you want to display. Once the user adds credentials the user will get your dashboard. Probably the best and quickest option ... View more

Seems hostname of your Splunk server is: splunkhl04. You can try telnet splunkhl04 8000 You can know the IP of the server running ifconfig ... View more

If you're talking about new data that should have been indexed it will depend how you're getting this data. For example if you have UFs sending data to your indexers, they have a default configuration of in-memory input queue of 500KB . If you do not change this behaviour when this queue fills the oldest data will be dropped. You will need to configure persistent queues to avoid that. See more information here: https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Usepersistentqueues. If you receive data from syslog and Splunk is listening for the data, I'm sorry but that is gone if you're using UDP syslog. For syslog, Splunk recommends having a syslog server/daemon listing to syslog messages before indexing to Splunk and them use a UF or HF to read the syslog files. Hope this helps clearing the idea. ... View more

Do you mean what hosts, source, sourcetypes are sending data to the main index? You can use the metadata command for that. On the Splunk search bar enter: |metadata type=hosts index=main You can also change hosts for sourcetypes or sources ... View more

I good start using the datamodel accelerated data from ES is: | tstats summariesonly=true dc(Web.user) from datamodel=Web by Web.url ... View more

You need to get a warnings reset license. This is usually 0bytes and it reset the previous warnings you had. Believe you can just open a support request with Splunk for that. ... View more

Sorry, I was on a few busy weeks couldn't get a response to you. If you still didn't get it working a few things that will help you via the Splunk CLI (log on to the SSH/RDP on the Splunk License Server and run those commands as the Splunk user): To list the license slaves (Indexers/Search Heads etc) reporting to the license server: /opt/splunk/bin/splunk list licenser-slaves This will show up the GUID, of each Slave reporting to the license server along with the instance name (under label ) Example: [splunk@deploysrv ~]$ /opt/splunk/bin/splunk list licenser-slaves 8052D46A-D7F8-49DB-9BA3-828C7FE87DBC active_pool_ids: auto_generated_pool_enterprise label:idx02.local pool_ids: auto_generated_pool_enterprise auto_generated_pool_forwarder auto_generated_pool_free stack_ids: enterprise forwarder free warning_count:0 D79A9D7B-4DE3-497A-80BD-90FEF14971C0 active_pool_ids: 10gb_test_pool label:deploysrv.local pool_ids: 10gb_test_pool auto_generated_pool_forwarder auto_generated_pool_free stack_ids: enterprise forwarder free warning_count:0 EBF81948-E2DB-49F5-B4FF-CB90129C7A94 active_pool_ids: auto_generated_pool_enterprise label:idx01.local pool_ids: auto_generated_pool_enterprise auto_generated_pool_forwarder auto_generated_pool_free stack_ids: enterprise forwarder free warning_count:0 Now that you have the GUID, you can can add a new license pool: /opt/splunk/bin/splunk add licenser-pools <poolname> -quota <quota> -slaves <guids> -stack_id enterprise Example command: /opt/splunk/bin/splunk add licenser-pools 20gb_pool -quota 20gb -slaves 8052D46A-D7F8-49DB-9BA3-828C7FE87DBC -stack_id enterprise You can also edit a current license pool to add a new indexer: /opt/splunk/bin/splunk edit licenser-pools <pool_name> -slaves <slave_guid> -append_slaves true Example: /opt/splunk/bin/splunk edit licenser-pools 20gb_pool -slaves EBF81948-E2DB-49F5-B4FF-CB90129C7A94 -append_slaves true All is documented here: https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/LicenserCLIcommands ... View more

Hey, the rest command is on the Splunk SPL ... View more

If you're looking for automation the best way to go is probably to use the CLI. See this docs for a number of CLI commands that will help you add/edit etc a license-pool or license: https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/LicenserCLIcommands. GUIDs are related to licenses and you don't assign a license to a pool, you assign a capacity from the full available license so it won't matter anyway what GUID you want to use. For example if you have 5 100GB licenses you can create a pool with 50Gb, another with 300Gb and another with 150Gb. Hope this helps, if yes just mark it as resolved 🙂 ... View more

Hi, See below: To get the list of license pools, on the license master or another server that have the license master as a search peer run: | rest splunk_server=<your_license_master_instance> /services/licenser/pools To get the GUIDs: | rest splunk_server=<your_license_master_instance> /services/licenser/licenses Do you mean license usage logs? That will be located inside the index=_internal source=*license_usage.log* . You can also play with the License Report Feature from Splunk, on the license master: Settings > Licensing > Usage report To create a new license pool, on the license server: Settings > Licensing > Add pool , give it a name, description and you can choose the license allocation there and what indexers will be connected to that pool ... View more

This REPORT-fields will work on search time. Try to create a temporary index and import the file with those settings and see if it works. I tried on my lab and seems to work fine. ... View more

You can change the saved search and remove the stats command from it. Other options would include create a new saved search with the same contents from the previous one and remove the stats and a third option is to use a macro with variables. The macro would filter the site. The macro can be pretty much the same as your saved search. ... View more