Well, on the cluster master you will never have any data in the indexes shown using this API endpoint /services/cluster/master/indexes . Maybe the cluster-bundle apply or verify commands update the endpoint? ... View more

Do I get you right here, you created an index on the master in master-apps that will be pushed out to the idx cluster peers only? In this case the idx will never show up anywhere on the cluster master, because you did not create it there. Hope to understand the question correct ¯\_(ツ)_/¯ cheers, MuS ... View more

Hi simpkins1958, As @p_gurav already said, check the file system or folder permissions. Running Splunk on Windows is a pain and you just hit one of many issues - for a long list of issues see this post: https://answers.splunk.com/answers/516059/what-are-the-pain-points-with-deploying-your-splun.html cheers, MuS ... View more

As @adino said use summary indexes to provide the events to each of the groups/roles OR create datamodels for each of them and mask or just provide the events they need, and accelerate the datamodel once done. cheers, MuS ... View more

Hi kulsplunk, have a look here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html , where it is explained how it can be done. Basically you can start with this base search: index=idx_1 OR ( index=idx_2 sourcetype=RGN_ST source=RGN lookup_name="region" ) OR ( index=idx_2 sourcetype=CUST_ST source=CUST lookup_name="customer") next is using eval to normalise the fields if needed, otherwise just use a stats to get the values by cust_id, rgn_id | stats values(*) AS * by cust_id, rgn_id Hope this helps to get you started ... cheers, MuS ... View more

Hi hkkenderson, blacklist is using regex to match, therefore you should use \. instead of just . . Try this: blacklist = app\.domain\.com\.access\.https\.log This assues you want to literally match one dot and not just anything one time. Hope this helps ... cheers, MuS ... View more

As I mentioned, I don't know TFS but google is always your friend and will give you this link as one of the first search results https://docs.microsoft.com/en-us/vsts/user-guide/tools?view=vsts cheers, MuS ... View more

Hi mawomommoh, I don't know TFS, but the general answer is: Yes, you can use version control software in Splunk. There are plenty of examples around related to git, like this awesome one https://answers.splunk.com/answers/312571/best-way-to-use-git-for-source-version-control-wit.html I'm pretty sure you can use it as template and get an idea how to do it. Hope this helps ... cheers, MuS ... View more

Hi michaelrosello, try this: index=indexA OR index=indexB | stats count dc(index) AS dc_idx values(*) AS * by Message_ID | where dc_idx = 1 | table Transaction_Type Message_ID The where clause is your filter to get events that are either only in one of the indexes (1) or in both (2). Hope this helps ... cheers, MuS ... View more

That's exactly my point, your dashboard is trying to load the js from the search app! Move your dashboard into the other redbar system_heath app and it should work. ... View more

quick shot: your error says /app/search/tooltip_js.js not found, but the file is in the redbar system_heath app ... View more

Sorry, but this is not entirely correct. See the docs on btool http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurations Btool displays merged on-disk configurations. That is, btool shows you the merged settings in the .conf files. It does not necessarily show you what Splunk software is currently using. So for example if you edit a .conf file and do not restart (and the edit requires a restart), btool reports the newly edited settings rather than the settings that are currently being used. To view current in-memory configurations, query the REST endpoint /services/properties/. or use this command: splunk show config web cheers, MuS ... View more

are you connecting from the same remote machine in both examples, or is one (the browser) local on the server that has the forwarder and curl is done remotely? Also, are you doing both calls with 'my.splunk.username' ? ... View more

you did what??? Please revert those changes. The universal forwarder does not need Python by default. It only needs Python if you want to run a python script using the universal forwarder. Still this is really weird ..... ... View more

Did you see my comment I posted just one minute before you posted your comment? ... View more

Wait a second, you get this error /opt/splunkforwarder/lib/python2.7/site-packages/splunk/clilib/cli.py': [Errno 2] No such file or directory ... but this is a universal forwarder ?! Splunk universal forwarder does not ship Python, the only Splunk software that ships Python is the full enterprise install. How did you install this version of Splunk; What package did you use and what command to install it? cheer, MuS ... View more

Okay, I tried it with this run everywhere search : <dashboard> <label>foobar</label> <row> <panel> <table> <title>table</title> <search id="baseSearch"> <query>| tstats count WHERE index=_* by index source | stats count by index source</query> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <title>table</title> <search base="baseSearch"> <query>| stats count AS CNT by index | eval MN="12" | where CNT &lt; MN</query> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> switched the lesser or greater than in every possible way, placed the base and post-processing search all over the place, and never got any error message like you mentioned in the question. My suggestion here is to check for any weird copy paste characters in the XML. Other than that I'm out of ideas ¯\_(ツ)_/¯ , beside of course check the job inspector or any Splunk logs for additional information what is causing this .... cheers, MuS ... View more

Hi marlykono, you need to encode the < as &lt; and > as &gt; in the XML like this: <query>| stats count AS CNT by index | eval MN=12 | where CNT < MN or modify the search string using the edit mode and then the magnifier to edit the search. Hope this helps ... cheers, Mus ... View more

can you provide a sample event in raw and let us know where Splunk truncates it? ... View more

Hi raghu0463, User permissions, app context, search modes (Fast vs Smart vs Verbose), knowledge objects permission, roles, even you mentioned it - but make really sure you are searching over the exact same time range (use a fixed range over yesterday for example), don't run real-time searches and compare results, late arriving events, time not in sync in your environment, wrong timestamp recognition ... the list is really long and did I mention time zones? Hope this helps in some way ... cheers, MuS ... View more

I just realised that I completely misunderstood your question :facepalm: ... View more

did you use the /opt/splunkforwarder/bin/splunk start command? ... View more