Can you share the current query? ... View more

You should be able to remove your local changes by deleting local/props.conf from the AWS add-on directory and restarting Splunk.  If you changed default/props.conf (never advised) then re-installing the add-on will restore the defaults. ... View more

The IN operator is not supported by the where command.  You can use IN with the search command or the in() function with the where command.  In this case, however, the IN is not needed if the subsearch is part of the base search (before the first pipe).     index=provisioning_index cf_org_name=abcd cf_app_name=xyz "ReconCount:" jobNumber [search index=provisioning_index cf_org_name=abcd cf_app_name=xyz operation="operation1" status=SUCCESS |search NOT jobType="Canc"|table jobNumber ] | stats count by deliveryInd | addcoltotals       ... View more

The current regex takes the first 4 digits and the last 4 digits and then puts them back together, which is why the result does not change.  Try this, which takes the first and last 3 digits and puts them together. | rex field=AcctCode mode=sed "s/(\d{3})\d-\d(\d{3})/\1\2/"   ... View more

I think you have the right idea, but streamstats doesn't work with multi-value fields.  Try this untested search index=myindex Token=* | streamstats window=2 range(_time) as time_gap by Token | stats list(_time) as _time list(time_gap) as time_gaps by Token | eval Date= strftime (_time,"%F %H:%M:%S.%2q") | where count > 1 | table Token Date time_gaps   ... View more

To which add-on do you refer?  The installation instructions for it should say on which instance(s) it should be installed, but if you give us the name then we should be able to provide an answer. Indexes, custom or otherwise, are always created on the indexers.  For a better user experience, they should also be defined on search heads.  Do that by deploying the same indexes.conf file to both instances, but without volume references on the SH. ... View more

I wonder if an outer join might have worked, but join is rarely the best answer because it performs poorly. One other approach is to use a subsearch to find the interesting transaction IDs and then search for those IDs. index="data" [search index="data" | stats values(eventtype) as eventtype by transaction_id | search eventtype="TYPE1" AND eventtype="TYPE2" | fields transaction_id | format ] | table *   ... View more

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it. https://www.duanewaddle.com/proving-a-negative/ ... View more

The answer depends on what you intend to test, but you should be able to treat the data as frozen and copy the buckets from all 3 indexers into the thawed directory to a standalone indexer.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Restorearchiveddata for how to thaw data. ... View more

The random function only returns an integer and there is no way to force it to include hyphens in the output. Since the function may return an integer too small for a phone number, I suggest using multiple calls to build it.  Here's an example using the North American Numbering Plan.     | eval PhoneNumber = (random() % 1000)."-".(random() % 1000)."-".(random() % 10000)     Additional massaging may be needed if you want more realistic phone numbers (no "001" for an area code, for example). ... View more

You have the right idea, but the strptime format strings don't match the example data.  Then simply subtract one from the other to get the difference.  Try this |eval Processing_Start_Time = strptime(HdtIn,"%m/%d/%Y %H:%M:%S.%6N") , Processing_End_Time = strptime(HdtOut,"%m/%d/%Y %H:%M:%S.%6N") , Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q"), diff = Processing_End_Time - Reception_Time   ... View more

@kp_pl wrote: index="odp" OR index="oap" txt2="ibum_p" | rename e as c_e | eval c_e = mvindex(split(c_e, ","), 0) | stats values(*) by c_e line 1 - two indexes joined and one of them filtered ( to create OneToOne relation). To clarify, line 1 does *not* join the indexes nor does it create a one-to-one relation. The OR operator tells the search peers to select all events from the odp index and the events in the oap index where the txt2 field has the specified value.  No relationship between the two indexes is made or implied and none should be inferred. To create a relationship, use the join (not preferred), transaction (also not preferred), or stats (preferred) command to associate the events by common fields, as in line 4. ... View more

Both HEC and the UF support ack.  While HEC does support higher volume, but both have good throughput.  We'd need to know more about how much data you intend to send to determine which is better. The data send to HEC has to be in a particular format and ACKs must be checked periodically, so there must be a client that has to be maintained by the customer. There is no additional cost (from Splunk) for either approach. Yes, you will want an add-on, especially if you use the UF (but may also be needed for HEC).  The add-on ensures the data is onboarded properly and defines the fields to be extracted. ... View more

What exactly did you change and what were the expected results? The comments in transforms.conf and props.conf must not be un-commented because they are not valid settings. ... View more

The default behavior is for the indexer to create enough copies of the data to meet the RF before sending an ACK.  That can be changed in server.conf, however.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Useforwarders#How_indexer_acknowledgment_works for details. ... View more

Enable the CAP_DAC_READ_SEARCH capability.  See https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/Installleastprivileged ... View more