Yes, the JAR file can be removed safely. ... View more

I just now realized you're using a chart rather than a table, but the $row.field$ convention should still work.  This table shows the tokens available from a chart. I wonder if it might help to rename the p99 result and use the new name in a token.     | chart p99(memory_usage) as p99 by _time, cluster</query>     Token Description   $click.name$ X-axis field or category name for the clicked location. Not available if the user clicks the chart legend.   $click.value$ X-axis field or category value for the clicked location. Not available if the user clicks the chart legend.   $click.name2$ Y-axis field or series name for the clicked location. Not available if the user clicks the chart legend.   $click.value2$ Y-axis field or series value for the clicked location. Not available if the user clicks the chart legend.   $row.<fieldname>$ Access any y-axis field value corresponding to the clicked location x-axis. Not available if the user clicks the chart   legend.   $row.<x-axis-name>$ Access any x-axis field value corresponding to the clicked location. Not available if the user clicks the chart legend.   $earliest$ Earliest time for the clicked chart segment. If not applicable, uses the earliest time for the search.   ... View more

Note that SEDCMD replaces text - it doesn't delete events.  So, in the end, you may still end up with an (empty) event with no timestamp. To delete the header, use a transform  or Ingest Action that routes the header to nullQueue. Props.conf: [mysourcetype] TRANSFORM-noheader = removeHeader Transforms.conf: [removeHeader] REGEX = ^Timestamp DEST_KEY = queue FORMAT = nullQueue   ... View more

There are good examples of HEC usage in the docs.  Start with https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Data/UsetheHTTPEventCollector ... View more

You can get a free developer license at dev.splunk.com.  All other licenses require a fee.  Contact Splunk Sales for details. ... View more

Once you have received your license file from Splunk, go to Settings->Licensing and click the green button to add it. ... View more

As the name implies, Admin Config Service (ACS) is for making administrative configuration changes to a Splunk Cloud stack.  It does not provide a means for exporting data. The 401 error means the credentials supplied with the ACS request are incorrect. ... View more

Ask them about it at https://ideas.splunk.com ... View more

I agree with @LRF   The problem is the log header line doesn't have a timestamp (and doesn't need one).  You can ignore the error or, as suggested, remove it. ... View more

Splunk's API does not support uploads of lookup files.  I've tried. ... View more

The bolded text, Y10212022, is not even close to the format specified in TIME_FORMAT. %Y%m%d%H%M%S needs 14 characters, but only 9 are bold.  Based on the format string, I expected to see "2023" somewhere in the event, but that's not the case.  What's more, the highlighted text is 3 fields (m,n,o) rather than the one or two fields we usually see for timestamps. ... View more

Do we have the complete raw events?  I ask because the sample events do not appear to have timetamps in them even though the TIME_PREFIX and TIME_FORMAT settings are present.  Without a complete event, it's impossible to confirm the accuracy of the regular expression. ... View more

What have you tried so far?  What separates each field?  ... View more

Use the Splunk App for Lookup File Editing (https://splunkbase.splunk.com/app/1724).  Export the lookup on the first SH and import it using the same app on the other SH. ... View more

Alerts are independent.  There is no test for triggering more than one alert (unless you're using Enterprise Security).  One alert would have to test for both (or more) conditions and trigger if all are met. ... View more

Make sure the sourcetype specified in inputs.conf matches the stanza name in props.conf.  Confirm the search heads were restarted since the .conf files were modified. ... View more

Are you seeing queueing in the HFs or indexers?  Which queues in the indexer are empty?  That will tell us where the delay is coming from. Can you add indexers?  Two may not be enough to support 3 sites, depending on the volume (which is what, BTW?). Consider adding another HF to each site for redundancy.  Why HFs instead of UFs?  You'll get better performance with UFs. ... View more

Yes, Federated Search works from Cloud to on-prem.  See the docs at https://docs.splunk.com/Documentation/Splunk/9.0.4/Search/Aboutfederatedsearch#Kinds_of_federated_searches_you_can_set_up Usually, however, a migration to Splunk Cloud includes moving historical data to the cloud so Federated Search (FS) is not needed.  There are a number of caveats to FS so you should approach it carefully. FS will not search cloud for recent data and on-prem for historical.  Instead, every search is sent to both the Cloud and on-prem indexers.  ... View more

All machines are vulnerable in some way so just install Splunk Forwarder on whatever you have available.  Whatever machine to select, be aware that Splunk and Splunk Forwarder do not detect vulnerabilities.  You can create reports in Splunk that report vulnerability information, but the vulnerabilities themselves must be detected by another program and reported to Splunk. ... View more

The $row.field$ construct only works if field exists; otherwise, you get the token as literal text. In the example, the chart command has discarded all fields except 'p99(memory_usage)', _time, and cluster so those are the only fields can be passed in a drilldown. ... View more

While it's possible to read some data from a remote PC, it's far easier to install Splunk on the computer where the data resides.  That can be a full instance of Splunk Enterprise or a Splunk Universal Forwarder (agent). Instructions for installing Splunk on Windows are at https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/InstallonWindows To learn about monitoring remote PCs, see https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata ... View more