I'm not aware of a way to do that. ... View more

I wasn't asking for the time range of when the alert runs, but the time range the alert searches.  It will in the dispatch.earliest and dispatch.latest fields in savedsearches.conf or rest /services/saved/searches. If the alert runs every 15 minutes and searches more than 15 minutes of events then results will be repeated. ... View more

The append command adds its results to the bottom of the current result set.  If the main search returns results "foo" and "bar" and the append returns "baz" and "bat" then the final resullt will be foo bar baz bat No relationship is made among any of the results.  You need to do that yourself.  Usually, that's done with the stats command using any field(s) common to all results. <<main search>> | append [ <<some other search>> ] | stats values(*) as * by blah ... View more

Search splunkbase (apps.splunk.com) for a TA/add-on that is pertinent to your data.  Follow the instructions there to install the TA. For general instructions about installing add-ons, see https://docs.splunk.com/Documentation/AddOns/released/Overview/Installingadd-ons ... View more

What are the earliest and latest settings for the alert?  How often does it run?  Is throttling enabled? ... View more

The abc.duration and abc.hardware fields were discarded by the stats command so they are not available to any commands that follow.  This is the nature of transforming commands like stats. If you need to add data from another event then use the append command to add on a query for the desired event.  You then will need to merge the results based on shared field(s). ... View more

That's strange. Have you tried removing the peers via the CLI? splunk remove search-server -auth admin:password 1.1.1.1:8089 ... View more

Perhaps you could use the signature or signature_id field. Avoid modifying a Splunk-provided DM.  Once you change it you essentially own the DM going forward.  Any change Splunk makes will be overridden by your local changes so you will have to merge Splunk's updates into yours. ... View more

If those fields are all the same then there's no need for a case function.  Use the coalesce function to choose the first field that is present in the current event. index=csmp OR index=aws-business-map OR index=sim OR index=guardduty | eval BindleNew = lower(coalesce(AWSAccountName, BindleName, WAWT2-BindleName, CloudTrail-AWSAccountName, AWSAccountId)) | stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(WAWT2-BindleName), values(CloudTrail-AWSAccountName), values(AWSAccountId), values(Business) as Business by BindleNew | search AWSAccountName!="" Business="XP"     ... View more

Every Splunk input should have a sourcetype assigned to it. Every sourcetype needs to be defined in a props.conf file. Every props.conf stanza should have the "Great Eight" attributes, at a minimum. [mysourcetype] TIME_PREFIX = TIME_FORMAT = MAX_TIMESTAMP_LOOKAHEAD = TRUNCATE = SHOULD_LINEMERGE = false LINE_BREAKER = EVENT_BREAKER = EVENT_BREAKER_ENABLE = true Set values for each attribute that correspond to the data being ingested. ... View more

One event is a start.  It means the event is tagged correctly. The next step is install one or more TAs to extract fields from the data.  Then ensure the data uses CIM field (if the TAs do not do that for you). ... View more

The job shows zero events because it did not find any events.  Then question is *should* it find any events?  For some searches, it's perfectly normal to return zero results except in an error condition. Have you run the queries manually to see if results are returned? ... View more

That screenshot tells us nothing.  It is not the place to find out if the DM contains data.  It is merely the definition of the DM itself. To see if the DM contains data, use one of these commands | from datamodel:DLP | datamodel DLP search | tstats count from datamodel=DLP ... View more

First, create an app in the $SPLUNK_HOME/etc/shcluster directory of your SHC Deployer.  The app will contain a distsearch.conf file.  Push the app to the cluster using the apply shcluster-bundle command. Next, you need to delete the $SPLUNK_HOME/etc/system/local/distsearch.conf file from the SHC nodes.  I think the most effective way to do that is to stop all SHC members, delete the file, then restart the cluster.  Perhaps someone else will have a better answer that doesn't require an outage. ... View more

To know what devices are missing, Splunk needs a list of known device names.  It will not seek names out automatically.  That is why the linked article uses a lookup table.  You also could use another search to collect the names. <<your current search that produces a 'deviceName' field>> | eval found = 1 | append [ index=foo earliest=-2mon latest=-1mon | fields + deviceName | dedup deviceName ] | stats values(*) as * by deviceName | where found == 1 ... View more

Have you read this chapter of the CIM manual?  https://docs.splunk.com/Documentation/CIM/5.1.1/User/UsetheCIMtonormalizedataatsearchtime ... View more

As I stated previously, ingesting data is only part of the puzzle.  Have you examined the app to see what data it expects and where it expects to find it?  Do you have the data the app is expecting? ... View more

If you put two lists of names next to each other, what are the chances two names in the same row will match?  That's what's happening here. Appendpipe is the answer to a rare set of problems.  This is not one of them. Pick one lookup as the base and use the lookup command to see if the name exists in the other file.  The command is case-insensitive so no need to shift case when comparing.  If the name doesn't exist in the 2nd file then the lookup command will return NULL. | inputlookup lookup1.csv | rex field=host "(?<host>[^.]+)\." | dedup host | lookup lookup2.csv Host as host OUTPUTNEW Host | eval results = if(isnotnull(Host), "hit", "miss") | table host Host results   ... View more

This should answer the question index=csmp OR index=aws-business-map | eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName) | stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(Business) as Business by BindleNew | search AWSAccountName!="" Business-="1X" To add more indexes index=csmp OR index=aws-business-map OR index=index3 OR index=index4 | eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName, sourcetype="st3", foo, sourcetype="st4", bar) | stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(Business) as Business by BindleNew | search AWSAccountName!="" Business-="1X" I believe it will not solve the problem, however.  That's because the values function returns a multi-value field that doesn't work well with many other commands.  Multi-value fields need to be processed with mv* functions (mvindex, mvfind, etc). ... View more

It sounds like you're editing the file directly on an SHC node.  That's the wrong way to manage a SHC.  Edit the file on your SHC Deployer and apply the shbundle. ... View more

Try  this ... | transaction build_number,type startswith="started" keepevicted=true | where closed_txn=0 ... View more

That is the correct breakdown of a bucket name. ... View more

Error #1 should not reference the search log since there is nothing in the message that tells us what search is reported the error. You can ignore that suggestion.  You can, however, use the fsck command to attempt to repair the file. The other two error messages do not provide enough information to diagnose or fix anything.  Unless there are other messages that offer more context or information then you can ignore the error.   ... View more

A bucket is not corrupted because of how data is ingested.  A bucket becomes corrupted because of a system or application error.  Bucket corruption is not a data quality issue and data quality does not corrupt buckets.  However, if a bucket cannot be read because it is corrupted then data in that bucket cannot be included in search results. Data in Splunk is immutable.  Once the data is written to disk it cannot be modified in any way until it is deleted. You asked "When does the bucket becomes corrupt which also impacts the data quality in Splunk?".  I'll say it again: bucket corruption and data quality are two different and unrelated concepts.  Please do not conflate them.  Don't even use them in the same sentence. Data quality is about how Splunk processes events so they can be written to disk.  Bucket corruption is what happens to the files that are used to store the data.  One does not cause or affect the other. ... View more