Hi @evinasco08, You can check this document; https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Clusterstates   ... View more

Hi @evinasco08 , Yes that's normal and correct. Sorry for my typo, I edited my reply I advise keeping RF=2 and SF=2 with 3 indexers.   ... View more

Hi @AL3Z , Please try below; | rex field=_raw "System\.Exception:\s+(?<system_exception>[^\(\']+)" ... View more

Hi @AchimK, You should check input settings inside inputs.conf file. If you created this input using GUI it may be under search app. You can find the place using btool like below. splunk btool inputs list tcp --debug | grep 5514 This will show the path of inputs.conf file that you should edit to delete malformed TCP input.  ... View more

Hi @jokertothequinn, In order to query custom indexed fields you should add them in fields.conf on search heads; [location] INDEXED=true   ... View more

H, @meshorer, Yes, rest/health endpoint shows db_data and status off all services. https://docs.splunk.com/Documentation/SOARonprem/6.2.0/PlatformAPI/RESTInfo#.2Frest.2Fhealth  But maybe it is better to monitor the system using an external script or something else. This will alert you even system stops. ... View more

Hi @meshorer, Since your events could not be written to db, service would stop. That is why you should monitor system health. ... View more

Hi @MattKr , Docker containers have only minimum requires tools. It is not easy to add additional tools. Don't think this as a standart linux distribution. ... View more

Hi @Eshwar, Please try below; curl -k -u admin:password "https://localhost:8089/services/alerts/fired_alerts?output_mode=json&count=0" ... View more

@uagraw01 , I am not experienced about Kafka inside Kubernetes. Please check how to install Kafka Connect Cluster inside Kubernetes, after that you can install "Splunk Connect for Kafka" into this cluster. ... View more

Hi @Eshwar, You can add "output_mode=json" parameter to get json output. Please see below; curl -k -u admin:password https://localhost:8089/services/search/jobs/export -d search="search sourcetype=splunkd earliest=-1h" -d output_mode=json   ... View more

Hi @AL3Z, You can check directly from notable index, but using notable macro is much easier. `notable` | timechart count by rule_name ... View more

Hi @uagraw01, If your need is ingesting data from Kafka to Splunk, you can check  "Splunk Connect for Kafka" https://splunkbase.splunk.com/app/3862  ... View more

Hi @TwitchyB, You can try below; index="Index 1" OR index="Index 2" OR index="Index 3" | timechart count by index ... View more

Hi @LearningGuy, You can add a statistics table to show all values like below addition to @ITWhisperer solution; <dashboard version="1.1" theme="light"> <label>Test</label> <row> <panel> <chart> <search> <query>| makeresults format=csv data="StudentID,Name,GPA,Percentile,Email 101,Student1,4,100%,Student1@email.com 102,Student2,3,90%,Student2@email.com 103,Student3,2,70%,Student3@email.com 104,Student4,1,40%,Student4@email.com"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="charting.data.fieldShowList">[Name,GPA]</option> </chart> </panel> </row> <row> <panel> <table> <search> <query>| makeresults format=csv data="StudentID,Name,GPA,Percentile,Email 101,Student1,4,100%,Student1@email.com 102,Student2,3,90%,Student2@email.com 103,Student3,2,70%,Student3@email.com 104,Student4,1,40%,Student4@email.com"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </dashboard> ... View more

Hi @MuhammadMurad, I noticed you missed $ before '$SPLUNK_HOME', please try using $SPLUNK_HOME   ... View more

Hi @Derson, Thank you for the nice and detailed explanation and the test results. I cannot think of anything else to say. I agree with you that may be a bug, it seems better to open a support case for this issue.    ... View more

Hi @pranay03, Since your otel collector is already installed without start_at=beginning parameter, you should remove otel , delete checkpoint files on your nodes under "/var/addon/splunk/otel_pos/" folder, and install otel again.. This should make otel to re-read all files.  ... View more

Hi @Anurag101, It is not possible to help without knowing your data. Also, the solution depends on whether data is extracted or not.  If you can show some sample anonymized events, we can help by sample query. ... View more

Hi @AL3Z, You should go to default.xml at "Settings > User Interface > Navigation" menu while in your app. Use collection type for dropdown menus like below; Please update dropdown_menu_name1 and  dashboard_name1 with your needs. You can add more menus as you wish. <nav search_view="search" color="#1D1D1B"> <view name="search" default='true' /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> <collection label="dropdown_menu_name1"> <view name="dashboard_name1"</> </collection> <collection label="dropdown_menu_name2"> <view name="dashboard_name2"</> </collection> </nav>   ... View more