@bsrikanthreddy5, you can view the status on Cluster Master - Indexer clustering dashboard. The state should be shown as GracefulShutdown after the indexer decommissioned. ... View more

@manoharkalva , no problem 😉  I found out that the problem is because of the spaces in "output_mode = csv". Please try with output_mode=csv because of spaces "output_mode" raises an error, aslo "=" and "csv" words cannot processed.  I hope you will get the results now 😀 ... View more

I was testing on Linux 😀 , curl is working different on Windows. Below (changed single quotes with double quotes )should work on Windows; curl -ku username:paswd https://splunkapiurl:port/services/search/jobs/export --data-urlencode search="search cs_uri_stem="*/reporting/rptttt.xls" AND (cs_uri_query="reportName=ddd+Certification")|stats count by AssociateOID, OrgOID, date, o, reportName" -d output_mode=csv ... View more

Hi @GioCortez , please try below query; | stats count by orderNumber | where count=1 | addcoltotals ... View more

@pstalin_ , please try this; index=168347-np [| `last_np_sourcetype("index=168347-np","hardware")`] OR ( [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=300543) | stats dc(physicalElementId) as Devices   ... View more

Did you try exactly using my endpoint url and parameters? It seems you didn't add --data-urlencode parameter. When I tested it works fine.  ... View more

The problem is because of double-quotes inside the search string. Please try below; curl -ku username:paswd https://splunkapiurl:port/services/search/jobs/export --data-urlencode search='search cs_uri_stem="*/reporting/rptttt.xls" AND (cs_uri_query="reportName=ddd+Certification")|stats count by AssociateOID, OrgOID, date, o, reportName' -d output_mode=csv ... View more

Can you please share some sample data?  ... View more

Sorry,  I missed the streamstats, that is why count does not exists.  I think below query will work for you.   |datamodel events_prod events summariesonly=true flat | search _time>=1597968172.000 _time<=1598146450.0001 eventtype="csm-messages" tail_id=AN | eval crate_path=source | rename kafka_uuid as uuid, _time as timestamp, _raw as data | stats count max(timestamp) as timestamp latest(data) as data latest(crate_path) as crate_path by uuid | sort 0 - timestamp | head 1000 | addcoltotals labelfield="Total events" count     ... View more

You can change fields command with table; |datamodel events_prod events summariesonly=true flat | search _time>=1597968172.000 _time<=1598146450.0001 eventtype="csm-messages" tail_id=AN | eval crate_path=source, count=1 | rename kafka_uuid as uuid, _time as timestamp, _raw as data | table uuid, timestamp , data, crate_path | dedup uuid | sort 0 - timestamp | head 1000 | addcoltotals labelfield="Total events" count ... View more

So, most probably the events that missing has not requires tagging for Malware datamodel. Since datamodels are working based on tags, Malware model searches the events with "malware" and "attack" tags. Please check the missing events tags with below search.  index=missing_index sourcetype=abc | stats count by tag If you don't see "malware" and "attack" tags you should check eventide and tag settings for missing sourcetypes. https://docs.splunk.com/Documentation/CIM/4.18.0/User/Malware  ... View more

@warsaw , data models constraints can be set by index and sourcetypes too. Maybe your Malware model is restricted to only some spesific sourcetypes from that index. You can go to settings / Data Models / here you can click on each data model and see in the constraint which macro the DM is using, and then you can modify that under Settings/Advanced Search/Macros. ... View more

Since there is no stats command in the search I thought it is normal to show 1,2,3.... The last row will show the count of events.  Maybe you can try below query.    |datamodel events_prod events summariesonly=true flat | search _time>=1597968172.000 _time<=1598146450.0001 eventtype="csm-messages" tail_id=AN | eval crate_path=source, count=1 | rename kafka_uuid as uuid, _time as timestamp, _raw as data | fields uuid, timestamp , data, crate_path | dedup uuid | sort 0 - timestamp | head 1000 | addcoltotals labelfield="Total events" count     ... View more

@sarit_s , you can use streamstats command to count events. |datamodel events_prod events summariesonly=true flat | search _time>=1597968172.000 _time<=1598146450.0001 eventtype="csm-messages" tail_id=AN | eval crate_path=source | rename kafka_uuid as uuid, _time as timestamp, _raw as data | fields uuid, timestamp , data, crate_path | dedup uuid | sort 0 - timestamp | streamstats count | head 1000 ... View more

@dailv1808 , I would upgrade DBConnect3 app to the latest supported version. DBConnect 3 works much faster and stable than DBConnect2. This may resolve errors and slowness.  Regarding card numbers you can use SEDCMD on props.conf to anonymize data. Of course you are limited by Regex SED capabilities. You can find details on below doc page. https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/Anonymizedata  ... View more

So, I agree with @harsmarvania57 , you should check your extractions props.conf and transforms.conf for "scheduler" sourcetype. ... View more

@vn_g, the problem seems on source field. Splunk source field for scheduler logs in not "scheduler". It contains full path. Can you please try below query? index=_internal sourcetype=scheduler alert_actions="*email*" OR index=_internal source=*scheduler.log alert_actions="*email*"   ... View more

Hi @woodcock, Since all these inputs are disabled by default, in any case, you will need to create an inputs.conf file to enable them. I would edit the script path while creating inputs in the app (i.e. org_all_indexers_inputs ) that I create for input settings for indexers. ... View more

Hi, you can just use Broken Hosts App for Splunk "The Broken Hosts App for Splunk is a useful tool for monitoring data going into Splunk. It has the ability to alert when hosts stop sending data into Splunk, as well as inspect the last time the final combination of data was received by Splunk." Thanks to Hurricane Labs ... View more

Hi arkonner, You can easily pass any clicked value to another dashboard using Drilldown setting of the map. Your destination dashboard should have an input that selects router/county. Lets's say destination token name is router_token and map field name on your source dashboard is router_name . On drilldown editor select Link to dashboard as On Click event, choose relevant App and Dashboard. On Advanced>Parameters you should set as form.router_token = $row.router_name$ When you click on a router on the map it will open the destination dashboard with router_token value set. I hope this helps. ... View more