Try this query index=test | stats count(eval(status>399)) as Errors,count as Total_Requests, values(Status) as list_of_Status by consumers | eval Error_Percentage=((Errors/Total_Requests)*100) ... View more

Nit: the instance is *managed* by Splunk, but it is *hosted* by either AWS or GCP.  Contact your Splunk admin if you don't know which host you have. If you're not on a trial account then the port number will be 443. Make sure the computer you are connecting from is on your Splunk Cloud Allowed IP List. ... View more

It would help if you told us a little about the issues you having rather than just saying you have issues. We also need to know which platform you use (AWS or GCP) and if it is a trial or paid account.  Those answers are used at https://docs.splunk.com/Documentation/Splunk/9.3.2/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector to determine the correct endpoint.  It could indeed be a port error. The URL from which you got a response is a REST API endpoint, not a HEC endpoint. ... View more

Don't ingest syslog directly into Splunk.  Use a dedicated syslog server.  See https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html and https://kinneygroup.com/blog/splunk-syslog/   ... View more

Enabling maintenance mode simply tells the Cluster Manager to not bother doing bucket fix-ups.  Nothing happens on the indexers themselves. The upgrade-init command starts a rolling restart of the indexers after setting maintenance mode. ... View more

I'm not sure what that statement means.  props apply only to the sourcetype, source, or host listed in the stanza name.  It may be necessary to replicate a stanza to cover all scenarios. ... View more

See the Getting Data In manual. ... View more

In Dashboard Studio it's $row.<<fieldname>>.value$. $row.host.value$ ... View more

This is a better answer than mine.  $results$ will only pick up the first result rather than the row clicked. ... View more

That is a Splunk internal index so any documentation (if it exists) would be internal to Splunk.  You may be able to find some useful information in the Troubleshooting Manual or the REST API Reference Manual. ... View more

Use $results.host$ ... View more

In addition to what @PickleRick wrote, what problem are you trying to solve?  Splunk is quite capable of parsing XML logs so why are trying to re-format them?  Why not use a transform to extract the fields directly instead of the interim SEDCMD step? ... View more

We need more information.  How data will be ingested each day?  How long will that data be retained?  How much searching will the system perform? If you have a single indexer then there is no need for a Cluster Manager (f.k.a. Cluster Master) and the search head can serve as the License Manager on such a small system.  If larger ingest amounts and for better search performance, multiple indexers may be needed, which call for a Cluster Manager. Syslog data should not sent directly to a Splunk process.  Instead, send it to a dedicated syslog server (rsyslog or syslog-ng) and write it to disk.  Have a Splunk Universal Forwarder monitor the disk and forward the data to the indexer(s). ... View more

It is possible to break events on *anything*.  It would help to see a sanitized example of the events you wish to break, but these settings should help. SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d\d:\d\d ... View more

It's not clear what is being asked.  What we know about how the coldToFrozenScript is processed is documented in indexes.conf.spec. If there's something more specific you want to know then please revise the question. ... View more

According to the documentation, you may upgrade 9.1 directly to 9.3. ... View more

The field (not "column") returned by the subsearch ("unique_id" in Version 1 and "ignore" in Version 2) must exist in the main search. ... View more

This thread is more than two years old with an accepted answer.  It's also on a completely different topic.  For a better chance at having people see and respond to your request, please post a new question. ... View more

That's a valid point about HEC events being able to specify any source value, however, that would not be associated with an app and so would not apply to the OP's request. It's possible a transform can be used to change the source name to something else.  Those can be found by searching the transforms.conf file on an indexer (or on the Cluster Manager). ... View more

The REGEX does not match the sample data because backslashes must be escaped.  Try REGEX = \\"file\\":\s*\\"(.{5000,}?)," ... View more

Since it's inputs.conf, they'll be distributed among the forwarders and so harder to search.  The best approach likely will be to use the CLI to scan the deployment-apps directory on the Deployment Server. find /opt/splunk/etc/deployment-apps -name inputs.conf -print0 | xargs -r0 grep -i "logs\/abc\/def" A complicating factor is the potential use of wildcards ('*' and "...") in monitor stanzas.  I'm sure you can modify the grep to find those. ... View more

We've established the disk is very full, but have not established what is using that space.  I suspect several indexes are combining to fill up the disk, but the du utility can verify that. ... View more