Hi I added api key for splunk add-on builder but I am getting error as " no connection could be made as target machine is actively refusing when the sending URL https://api.splunk.com . Can someone please help with the error I made. I also tried adding api-key in header section but still the same issue. ... View more

Hi there, is there any query to find out the forwarders which are reporting for last 1 day or f there is a delay in the logs. Thanks ... View more

Hi there, Is there any way to find out who are the users queried for a particular word in Splunk? For example, i would like to find out all the users who queried for a word called "apple" or whose queries contain a word "apple" . Thank you ... View more

Hi, I am writing the transforms to hide the bankID for the below event. 14:14:09,573 ERROR [J2DefaultEngine] [0.0.0.0] [111111] [abcfder1,,stg8sfv8_ACNSFQA1.,dbquote3,data1,data2,en_US] Failed record info: {PerbankId/cardType=xyz-bcf, PerbankId/country=hma, PerbankId/isPrimary=true, PerbankId/bankId=123-345-789, , PerbankId/personIdExternal=123456789}. but the transforms i am trying is not working as the bankID can't be replaced with the XXXXXX. can someone please help with the transforms REGEX = (.*bankId=\d{3}\-\d{3}\-\d{4}).* FORMAT = $1bankId=xxx-xxx-xxxx$2 DEST_KEY = _raw ... View more

I am looking for indexes which are utilizing only 10%-20% of storage allocated to them. Can i please know is there any query to find out that.I know that we can look into DMC but i specifically need only the indexes that uses only 10%-20% of storage for last 30 days. ... View more

Can I please get help to modify the below query to display results of each day for last 30 days which will show the rawtotal diskTotal compression | dbinspect index=webserver_index | fields state,id,rawSize,sizeOnDiskMB,index,splunk_server | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index splunk_server | eval diskTotalinGB=round(diskTotalinMB/1024,2) | eval rawTotalinGB=round(rawTotal/(1024*1024*1024),2) | fields - rawTotal | eval compression=tostring(100-round(diskTotalinGB / rawTotalinGB * 100, 2)) + "%" | table index, splunk_server, rawTotalinGB, diskTotalinGB, compression | addcoltotals rawTotalinGB diskTotalinGB labelfield=splunk_server label="Total Usage(GB)" ... View more

Can I please know how to track the license increase? For example , I have an sourcetype "access_log" which has contributed 500GB of license yesterday but today if the same sourcetype contributed 700GB, I would like to see it in visualization. Right now, I am using below query to find top contributing sourcetypes. index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb/1024/1024)) AS GB by series | sort – GB ... View more

Can someone help me how to modify the below query for different servers. For example, i have 10 servers like dbm1,dbm2,dbm3,....,dbm10. But i would like to see the output "total GB used" for each server for that sourcetype not for the group. Moreover, can I please know how to mention sourcetype in the query because when i say sourcetype=access_log , it is not working. index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage sourcetype=access_log | rex field=h "(ac1|bc1|cs1)(?P\w+[^\d+])" | search Group=dbm | eval GB = b/1024/1024 | rename s AS source | stats sum(GB) AS "Total GB used" by Group ... View more

Can i please know how to calculate license usage of a particular sourcetype from a specific host before indexing ? For example , i have host "webapp01" having a sourcetype "access_log" but i would like to calculate how much data this sourcetype is sending to splunk before indexing to understand license consumption . ... View more

hi there, Is there a way to check what sourcetypes a universal forwarder is sending to heavy forwarder. Any query or CLI command ? ... View more

We have 3 heavy forwarders and universal forwarders are sending data to these 3 HF. But the CPU usage on one of the heavy forwarder is high. Can I please know how to troubleshoot the issue, why the CPU utilization is high on one of HF. ... View more

Hi, For example, we have 2 universal forwarders UF1 = web01abc23 UF2 = web01cde21 Both are having same inputs.conf as under an app called "app_all_web" and this app is pushed from deployment server. Both of the UF are same having same monitoring stanza like [monitor://xyz.log] sourcetype=web_log index=abc But I would like to add tcp_routing attribute to monitoring stanza on UF2 like below. [monitor://xyz.log] sourcetype=web_log index=abc _TCP_ROUTING=HeavyForwarders_1 If make change in the app and push it, then it will be pushed to UF1 which I don't want because I want that change only on UF2. My idea: create an new app blacklist UF2 on "app_all_web" whitelist UF2 on new app (new app contains all the changes that i need) I would like to get suggestions is it possible to do under same app without creating new app. ... View more

Hi , I installed a heavy forwarder for regex processing a few source types, not for indexing. How can I know whether the heavy forwarder is processing the regex? How can I check the memory consumption and CPU consumption from the search head or DMC (heavy forwarder is connected to DMC)? ... View more

Hi there, Is there a way to send specific sourcetype to a heavy forwarder? For example, I would like to send the "database_access" sourcetype to the heavy forwarder for regex parsing and then send the other sourcetype ("webserver_Access") directly to the indexer. monitor://abc.log sourcetype=webserver_Access index=webserver_all monitor://cdef/log sourcetype=database_Access index=database_all ... View more

Hi There, Can i please know the ports to be opened for heavy forwarder , indexer , universal forwarder ? ... View more