It's not that $earliest$ is not being passed, it's that the value being passed is invalid.  The value for the earliest option must be a time modifier ("-1d", for example) or a timestamp in the format %m/%d/%Y:%H:%M:%S.  It cannot be an epoch timestamp, but you can use strftime to convert an epoch into the expected format. | eval earliest = strftime(earliest, "%m/%d/%Y:%H:%M:%S")   ... View more

The disk is full.  The resolution is to free up space or add more storage. Indexes should not be allowed to grow large enough to fill the disk.  Indexes should be part of a volume that is smaller than the total disk space available (to allow for metadata).  That MinFreeSpace is 5GB and disk space is 0 tells me that Splunk is sharing storage with other applications and/or the OS.  That is a Bad Practice. The operating system, $SPLUNK_HOME, and $SPLUNK_DB should be on separate and independent mount points. ... View more

You probably could define TIME_PREFIX to find that timestamp.  However, is the timestamp present for every event or just once in the file?  If the latter, then start writing code to re-process that file into something Splunk can ingest more easily. ... View more

Check search.log and python.log for any messages that might explain why the script returned an error code. ... View more

Please confirm the "bin" field is present in the index.  It is not created by the bin command. If the 'bin' field is null or not present then the stats command will return no results and so the streamstats command will have nothing to evaluate. ... View more

You can use the savedsearch command to run a saved search in your query.  If you use the time picker to specify a time range other than All Time then the saved search will use your selected time range; otherwise, the time range in the saved search will be used. ... View more

While every sourcetype should have props defined, this may be beyond what transforms can do.  Timestamp extraction happens before transforms are applied, which is why I suggested an input script do the work. ... View more

Wow.  The developer that created that log needs to be taught how to use Splunk so he can see how awful his creation is. Is that one event or several?  Or is that the prologue to the log file? You may be able to use a custom datetime.xml file or you may want to consider an input script that normalizes the timestamp. ... View more

According to this chart, I single indexer should be enough for the volume of data.  A lot depends on the number of searches being run, however, something Splunk's chart tries to capture in the "number of users" figures. If you have fewer than 24 users, but still do a lot of searching then it may be worthwhile to add an indexer or two. Once the data is re-balanced among the indexers, each will perform a fraction of the work and the search should complete in a fraction of the current time. Also, consider adding a sourcetype specifier to the base search as that can help improve performance. ... View more

Typical GDI troubleshooting steps include: Verify the input configuration, including the URL and credentials. Verify the Splunk server running the add-on can connect to the MS server.  Use curl or a similar tool. Check splunkd.log for related messages. Check the MS logs for related messages. If you're using Splunk search to see if data is coming in then double-check the SPL.  Verify the index name.  Try specifying latest=+1y to account for timestamp errors. ... View more

Data will not be indexed automatically after adding the add-on.  Inputs must be configured so the add-on knows where to find the data.  See https://docs.splunk.com/Documentation/AddOns/released/MSSecurity/Configure ... View more

Replace stats in the query with timechart and it should work. index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage idx=* | timechart span=1d sum(b) as usage | eval usage=round(usage/1024/1024/1024) | eval usage = tostring(Used, "commas")   ... View more

What have you tried so far?  What error do you get?  Are you trying to extract the field at index-time or search-time? Have you tried this rex command in your search? | rex "SourceIp\\\\\\":\\\\\\"(?<SourceIp>[\d\.]+)" ... View more

So you didn't "find something else that helped".  You used my answer. ... View more

I don't understand the reply.  Did my answer work or not?  If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

We still don't know *how* you are trying to extract fields.  The erex command and the extraction wizard struggle with complex events so consider using one of the commands suggested by @yuanliu . If you only need a few fields, you may have some luck using the rex command to extract them. ... View more

We need more information. How exactly are you trying to extract the fields?  Have you tried any other ways to extract them? Please share a sanitized example event and indicate which fields you wish to extract. ... View more

To graph data over time requires the _time field and a charting command.  Usually, I use timechart, but it only supports a single field so this query uses chart. | tstats count as Requests sum(attributes.ResponseTime) as TotalResponseTime sum(attributes.latencyTime) as TotalatcyTime where index=app-index NOT attributes.uriPath("/", null, "/provider") by _time span=1d | eval TotResTime=TotalResponseTime/Requests, TotlatencyTime=TotalatcyTime/Requests | chart max(TotResTime) as TotResTime, max(TotlatencyTime) as TotlatencyTime over _time ... View more

Putting the queries together is pretty simple, but getting a usable graph from the result is another matter. | tstats count as Requests sum(attributes.ResponseTime) as TotalResponseTime sum(attributes.latencyTime) as TotalatcyTime where index=app-index NOT attributes.uriPath("/", null, "/provider") | eval TotResTime=TotalResponseTime/Requests, TotlatencyTime=TotalatcyTime/Requests | fields TotResTime TotlatencyTime This will produce two single-value fields, which isn't enough for an area chart.  What is it you want to show in the chart? ... View more

Which of the 4 suggestions did you try?  Did none of them help? It would help to have the event in text rather than as an image since it's impossible to put an image in regex101.com for testing.  Try this untested prop [mysourcetype] SEDCMD-noContext = s/Context Information:.*/Context Information:/g ... View more

I think you'll find the contents of the multi-select token are a multi-value field.  That means any place you use $sub_competency$ must make sense with a multi-value field.  Perhaps | search Sub_Competency IN ("$sub_competency$") would work better. As @marnall suggested, it depends on what the token contents look like. ... View more

That event does indeed contain in instanceId field, but the sourcetype may not match the "veeam_vbr_syslog" value expected by the DM.  It's hard to tell from the obscured screenshot. Everything in the "constraints" section of the DM must match your data for it to be found by the DM and appear in the dashboard. ... View more

I see a few issues, but don't know that fixing them will solve the problem. 1. All of the sed commands are malformed.  There should be a single "s/" at the beginning and only 2 slashes before the final 'g'. 2: I'm not sure quotation marks are allowed in a stanza name. 3. "WinEventLog://" is a prefix for inputs.conf stanzas, not for props.conf. 4. Have you tried using a sourcetype name in the props.conf stanza rather than a source name? It would help to see some sample events and to know which parts of the events you wish to remove. If you want someone to confirm the inputs.conf stanza then you'll need to show the inputs.conf stanza. ... View more

It's not that those indexes *should* not be replicated, it's that it's not a big deal if data is lost from them so you can save storage by not replicating them.  If you have a low risk tolerance then feel free to set repFactor = auto for those indexes (it won't hurt anything). ... View more