You are using Smart Mode or Verbose Mode, not Fast Mode ... View more

 You have the Splunk Add-on for Unix and Linux installed? ... View more

The show case package should be optional.  As of now it we have 60 pluss Splunk Enterprise server and this takes space on all of them.  It does not help to just remove the folder.  1.  We get error on staring Splunk due to the manifest files.  2.  It will just be reinstalled on next upgrade. ... View more

You are 100% sure your HF are listening on port 8089. ss -pultan | grep LISTEN should result in some like this: tcp LISTEN 0 128 0.0.0.0:8089 0.0.0.0:* users:(("splunkd",pid=3870899,fd=4)) ... View more

You need the username and password.   If you do not have it, but have control of your index server, you can reset it using cli, then reconnect search head to all index servere. ... View more

Then you make a dashbord with time picker to select 1day, 1 week or 1 month. ... View more

Not clear at all.  You can make a dashboard where you can dynamically select timespan. ... View more

Not sure if I understand the request.   | timechart span=1month avg(duration) as duration   Or average for week over month. | timechart span=1d avg(duration) as duration | timewrap 1w   ... View more

It would be hard to help if we do not see the raw data and the alert used. ... View more

What about: | timechart span=1w avg(duration) as duration ... View more

What do you mean with Dat Set Version of all Linux ? ... View more

I do not think there is an easy solution for this.  What you can do is to examine your data and set field alias so that thy will respond to same field name ... View more

If you like a custom format, yes, then your need to use eval and not convert. PS if you can accept the answer it would be fine 🙂 ... View more

Try this:   | stats min(_time) as time_min max(_time) as time_max | convert ctime(time_min) | convert ctime(time_max)       ... View more

We do UF on all our servers.  To not make to more complicated we use the UF to monitor the DNS log files.  ... View more

This is just a part taken from my posted dashboard in this thread:   index="_internal" "data/ui/views/" NOT "servicesNS/-" sourcetype=splunkd_ui_access | rex "(?<app>[^\/]+)\/data\/ui\/views\/(?<dashboard>[^? ]+)" | stats count by dashboard | sort -count     ... View more

We do use a dashboard to see the overall dashboard usage in our solution: <form version="1.6" theme="dark"> <label>Dashboard usage</label> <!-- 1.1 Added line view and host info 1.2 Added sort 1.3 Added sort by in dashboard 1.4 Fixed new forma 1.5 Fixed dashboard regex by adding space and added Pie chart 1.6 Fixed missing user --> <search id="base_search"> <query> index="_internal" "data/ui/views/" NOT "servicesNS/-" sourcetype=splunkd_ui_access | rex "(?&lt;app&gt;[^\/]+)\/data\/ui\/views\/(?&lt;dashboard&gt;[^? ]+)" | rex "servicesNS\/(?&lt;user2&gt;[^\/]+)" | rex mode=sed field=user2 "s/%40/@/" | eval user=if(user="-",user2,user) | search app=* host="$Host$" user="$User$" app="$App$" dashboard="$Dashboard$" | fields _time host user app dashboard </query> </search> <fieldset submitButton="false"> <input type="time"> <label>Max is 30 days back</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="Host"> <label>Host</label> <search base="base_search"> <query> | eval data=host | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="User"> <label>User</label> <search base="base_search"> <query> | eval data=user | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="App"> <label>Application</label> <search base="base_search"> <query> | eval data=app | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Dashboard"> <label>Dashboard</label> <search base="base_search"> <query> | eval data=dashboard | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Sort"> <label>Graph by</label> <choice value="dashboard">Dashboard</choice> <choice value="app">Application</choice> <choice value="user">User</choice> <choice value="host">Host</choice> <default>dashboard</default> </input> </fieldset> <row> <panel> <chart> <search base="base_search"> <query> | timechart limit=25 useother=f count by $Sort$ </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="height">400</option> <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option> </chart> </panel> <panel> <chart> <search base="base_search"> <query> | stats count by $Sort$ </query> </search> <option name="charting.chart">pie</option> <option name="height">385</option> <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option> </chart> </panel> </row> <row> <panel> <table> <search base="base_search"> <query> | sort 0 - _time | table _time host user app dashboard </query> </search> <option name="count">50</option> <format type="color" field="host"> <colorPalette type="map">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</colorPalette> </format> <format type="color" field="user"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="app"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="dashboard"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> </row> </form> ... View more

Not still sure how it works, but you need the html section and the table id= <dashboard version="1.1" theme="dark"> <label>Table with color Based on Status</label> <row> <panel> <title>Compliance check</title> <html depends="$alwaysHideHTMLCSSPanel$"> <style> #tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableColorFinalRowBasedOnData"> <search> <query> | makeresults | eval _raw="Version,Count,Status win 2012,20,compliance win 2008,35,Non-Compliance Xen 2.4,40,compliance win 2016,24,Non-Compliance" | multikv forceheader=1 | table Version Count Status | eval color=case(Status="compliance","#53A051",Status="Non-Compliance","#DC4E41") | foreach Version Count Status [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)] | fields - color </query> </search> <format type="color" field="Version"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Count"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Status"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> </table> </panel> </row> </dashboard> ... View more

We like to know the name of the HF server the data are passing trough, so we have this app on all our  HF server. prosps.conf [source::...] TRANSFORMS_set_hf_server_name = set_hf_server_name transforms.conf [set_hf_server_name] INGEST_EVAL = splunk_hf := splunk_server This uses the server name, so we do not need to set it.  All data will then be searchable using  splunk_hf=<something> We do also do the same for all collector servers and set splunk_collector (for Syslog/HEC/Azure etc) ... View more

Have a look at this: https://www.splunk.com/en_us/blog/tips-and-tricks/exporting-large-results-sets-to-csv.html?locale=en_us ... View more

Have you done any changes to the search head.  Use GIT or some other to track your changes if you do not use that. ... View more

Here is an updated version. Less use of not need table command, use of base search.  Dropdown with counters++   <form version="1.1" theme="dark"> <label>List of Users Capabilities</label> <!-- 1.1 based on https://community.splunk.com/t5/Security/How-can-I-generate-a-list-of-users-and-assigned-roles/m-p/194811 --> <search id="base_search"> <query> | rest /services/authentication/users splunk_server=local | replace "*%40*" with "*@*" in id | rex field=id "/users/(?&lt;user&gt;.+)$" | rename roles as role | fields user defaultApp id realname email role type splunk_server capabilities | search user="$user$" type="$type$" role="$role$" </query> </search> <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="user"> <label>User</label> <search base="base_search"> <query> | eval data=user | stats count by data realname | eval info=data." (".realname.")" | sort data </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="type"> <label>Type</label> <search base="base_search"> <query> | eval data=type | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="role"> <label>Role</label> <search base="base_search"> <query> | eval data=role | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> </fieldset> <row> <panel> <title>User Accounts</title> <table> <search base="base_search"> <query> | table user realname email type role splunk_server </query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <format type="color" field="action"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="host"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="type"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="role"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="splunk_server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <drilldown> <unset token="user"></unset> <set token="user">$click.value$</set> </drilldown> </table> </panel> </row> <row> <panel> <title>Role Capabilities</title> <table> <search base="base_search"> <query> | dedup role | mvexpand role | join role [ | rest /services/authorization/roles | dedup title | rename title as role ] | table role capabilities imported_capabilities | sort role | transpose 1000 column_name=role header_field=role </query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="action"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="host"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="type"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="roles"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="splunk_server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> </row> <row> <panel> <title>Role Index Access</title> <table> <search base="base_search"> <query> | table role | mvexpand role | dedup role | join role [ | rest /services/authorization/roles | dedup title | rename title as role ] | table role srchIndexesAllowed imported_roles imported_srchIndexesAllowed | sort role | transpose 1000 column_name=role header_field=role </query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="action"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="host"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="type"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="roles"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="splunk_server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> </row> </form>   ... View more