Splunk Hybrid Search has been replaced by Federated Search (FS).  It allows you to search both your local and Cloud indexes from the same search head.  There are plenty of caveats to FS so I don't recommend it for general use. You can, and this is very common, send your data to both your local indexers and to Splunk Cloud indexers at the same time.  That lets you use your on-prem system for historical searches while populating Splunk Cloud with data for a future cutover. Finally, it's also possible to transfer your data from your on-prem indexers to Splunk Cloud and switch over immediately to using Cloud.  That, however, requires Splunk Professional Services. ... View more

Each of those searches already has at least one specific filter so you know how to do that.  Please explain exactly what you want from us. ... View more

The opposite of filldown is to reverse sort the data, use filldown, then re-sort to the original order. ... View more

If you want events grouped by one or more fields then you want the stats command. | inputlookup appJobLogs | where match(MessageText, "(?i)general error") | rex mode=sed field=MessageText "s/, /\n/g" | stats values(*) as * by RunID   ... View more

Don't bother.  IN optimizes to a series of ORs so just start with that. index=syslog [ | tstats count from datamodel=Random by ips | rename ips as src_ip | fields src_ip | format ] The subsearch will run first and use the format command to produce a string like "(src_ip=1.2.3.4 OR src_ip=2.3.4.5)" which will become part of the main search. ... View more

How does the data get from the source file to Splunk?  If there are multiple readers then there could be duplicate data. ... View more

Are Tag1 and Tag2 in the same event?  If not, what field links the two events?  Where are you using the isnull() function? ... View more

Please share you search so we can offer suggestions to optimize it. VPC data can be huge so it will take time to process 6 months of it.  You should consider using a data model.  How much data is the search going through?  Is the data evenly distributed among the indexers? ... View more

Assuming by "volume" you mean the number of occurrences, try this index=foo "ERROR" host=bar earliest=-7d | stats count ... View more

There are two ways to exclude events containing certain words.  The first is to put the word(s) in the base search ( the part before the first |) preceded by "NOT".  It may be easier to put desired words here if that number is smaller.  This won't work if the work must be in a specific field this not yet extracted. index="600000304_d_gridgain_idx*" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "StatisticBalancer - statisticData: StatisticData" "TRIM.UNB.D082923.T045920" |rex "totalOutputRecords=(?<totalOutputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalAchCurrOutstBalAmt=(?<totalAchCurrOutstBalAmt>),totalAchBalLastStmtAmt=(?<totalAchBalLastStmtAmt>),totalClosingBal=(?<totalClosingBal>),totalRecordsWritten=(?<totalRecordsWritten>),totalRecords=(?<totalRecords>)" |table busDt fileName totalAchCurrOutstBalAmt totalAchBalLastStmtAmt totalClosingBal totalRecordsWritten totalRecords The other way is to use the search or where command to filter out events with the offending words (or keep those with desired words). index="600000304_d_gridgain_idx*" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "StatisticBalancer - statisticData: StatisticData" |rex "totalOutputRecords=(?<totalOutputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalAchCurrOutstBalAmt=(?<totalAchCurrOutstBalAmt>),totalAchBalLastStmtAmt=(?<totalAchBalLastStmtAmt>),totalClosingBal=(?<totalClosingBal>),totalRecordsWritten=(?<totalRecordsWritten>),totalRecords=(?<totalRecords>)" | where fileName="TRIM.UNB.D082923.T045920" |table busDt fileName totalAchCurrOutstBalAmt totalAchBalLastStmtAmt totalClosingBal totalRecordsWritten totalRecords   ... View more

The indexAndForward setting must be in the [tcpout] stanza. Please elaborate on "it didn't work". ... View more

There are few ways to limit the number of results.  The head, dedup, and stats commands can be used.  Which to use depends on the inputs and the desired results. index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | head 1 | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCMessage="ebnc event balanced successfully" | table EBNCMessage True index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCMessage="ebnc event balanced successfully" | dedup EBNCMessage | table EBNCMessage True index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCMessage="ebnc event balanced successfully" | stats values(*) as * by EBNCMessage | table EBNCMessage True   ... View more

What do you mean by "throughput limit"?  The UF has a rate limit which defaults to 256kbps.  The UF will read data at that rate until it catches up (if ever), but it will not stop reading. Tell us more about the symptoms so we can offer suggestions. ... View more

My first answer said how to create a table with events of the same job from both indexes, but then you said you don't want a table. ... View more

A new issue should be in a new question. ... View more

Assuming you have a "domain" field in both the lookup file and an index, this should get you started. index=foo [ | inputlookup denieddomains.csv | field domain | format ] The subsearch (inside square brackets) fetches the contents of the lookup table (I made up a name - replace it with your own), extracts only the "domain" field, then formats the results into a search string which is then returned to the main search for execution. ... View more

SmartStore has no effect on your license.  License use is determined by the amount of data written to disk, regardless of the storage method used. ... View more

The stats command will not return results for a groupBy field that is empty or null.  Use the fillnull command or enhance the eval statement to ensure the joiner field always has a value. ... View more

I assume you're referring to your splunk.com account.  I went through the same thing a few years ago.  You have to create a new account and ask the certification ([email protected]) and education ([email protected]) teams to transfer your records to the new account. ... View more

The Splunk Universal Forwarder does not need any additional software installed.  Everything it needs is in the package. ... View more

Splunk can index data locally and forward it to another system.  The assumption, however, is that the other system is Splunk. Splunk indexers can forward to non-Splunk systems, but only as raw TCP or syslog.  See https://docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Outputsconf#TCP_Output_stanzas and https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Forwarddatatothird-partysystemsd for more information. ... View more

The packet field appears to encoded or encrypted.  You would have to get with the vendor to determine how to make the field legible , if it can be done at all.  It's possible this is data straight off the wire and that you would need the SSL certificate to process the data - not something one can do in SPL. ... View more