Sometimes it's normal for a search to return no results.  It may be that there is no data that meets the search criteria.  This is especially true for searches that look for error conditions. Have you tried running the search within Splunk to see what it returns? ... View more

It depends on where TIME_PREFIX is placed in the props.conf file.  If it's in the [default] stanza then it will apply to all sourcetypes.  This is not recommended. The settings should be in (and would only apply to) a specific stanza, either for a sourcetype, source, or host. ... View more

The first step is to assign a default app to the new view-only role.  That will ensure the user goes directly to that app right after login. The second step is to change all other apps so the view-only role cannot access them.  For each app in the Manage Apps page, go to Permissions and choose the roles that are allowed access to the app.  Whenever a new role is created, repeat this process. ... View more

There is no setting that does what you desire.  KV_MODE = multi extracts fields from table-formatted data. ... View more

I see what I did wrong.  I've fixed my answer. ... View more

ODBC does not support ad-hoc queries.  They must invoke a saved search. ... View more

Try other time zone designations like America/Denver or MST. Frankly, some of what you've tried already should have worked.  Did you restart Splunk after changing props.conf?  Are you looking at newly-onboarded data after each change?  Indexed data will not change. ... View more

Add another streamstats to find the maximum value of Real_Status and then filter out events with a max value < 2.   Base_SPL.. | streamstats reset_on_change=true count as Real_Status by status,JobName | eventstats max(Real_Status) as conseq_status by status,JobName | where conseq_status > 1     ... View more

What have you tried so far?  Have you tried something like this in props.conf? [mysourcetype] INDEXED_EXTRACTIONS = csv HEADER_FIELD_LINE_NUMBER = 4 DATETIME_CONFIG = current ... View more

HOW did you try to solve the problem? This probably is not a line-by-line debugging scenario.  This is a case of examining the search(es) used by the dashboard and confirming you have the data sought by the search. Use the Edit button to open the dashboard then click the magnifying glass icon to see the search query.  Copy that query into a separate search tab/window.  Set the time range to match that used by the dashboard.  Remove everything from the first pipe (|) to the end of the query and run the search.  Verify you get results.  If you don't then something in the new query doesn't match your data and will have to be modified. If you do get results, then add the pipe and command from the original query and run the search again.  Verify you get results.  Repeat this process until you get no results.  That command will be the one causing the problem.  Modify that command so it works with the data you have.  Copy the resulting query back to the dashboard. ... View more

Every sourcetype should have props and lack of props in this case is the reason for the failure.  Without props, Splunk has to guess at your data and may guess wrong.  Try these props as a starting point [mysourcetype] TIME_PREFIX = ^\[ TIME_FORMAT = %m/%d/%y %H:%M:%S:%3N %Z MAX_TIMESTAMP_LOOKAHEAD = 50 TRUNCATE = 10000 SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) ... View more

Since this is Splunk Cloud, you should be able to view the props via the UI (if you have permissions).  Go to Settings->Source types and select the sourcetype used for Avamar data.  Click on the Advanced tab to see all of the settings in one place. These settings should be in an app that is stored somewhere on-prem, ideally in a source code management system. ... View more

That's what the isnull function does - it keeps results where the specified field has no value (not visible).  As per the OP: " only shows me the destination that is not in the search table".  If this is not what you expected then please clarify the requirements. ... View more

This often is caused by an incorrect TIME_PREFIX setting or an incorrect/missing TZ setting in props.conf.  Without a specified time zone, Splunk will assume the event occurred in the system time zone, resulting in events being off by hours. Please share the props.conf settings for the sourcetype. ... View more

Make sure your firewall is allowing connections to that host and port. ... View more

Your URL should be https://http-inputs-prd-p-m95xx.splunkcloud.com:8088 curl -k https://http-inputs-prd-p-m95xx.splunkcloud.com:8088 -H "Authorization: Splunk 11111111-2222-3333-4444-555555555555" -d "{\"event\": \"Hello, Anyone!\", \"sourcetype\": \"manual\"}" -v   ... View more

SED is search-time rather than index-time, but you could do it with this props: SEDCMD-replaceUpToComma = s/^([^,]*,[^,]*),/0/ ... View more

Use the isnull function to filter the results. | lookup DIDREPEP Destino OUTPUT Destino | where isnull(Destino) | table Destino   ... View more

Do the UF's logs confirm it downloaded the app?  Did the UF restart afterwards?  It won't process the new input until after restart.  Use btool on the UF to confirm the input is configured and the splunk list monitor command to verify the file is being monitored. ... View more

Azul is supported.  See https://docs.splunk.com/Documentation/DBX/3.12.2/DeployDBX/Prerequisites#Java_Runtime_Environment_.28JRE.29_requirements ... View more