The regular expression used in TIME_PREFIX must match the data, which is not the case in the example.  Try these settings. [mainlog:json] TIME_PREFIX = log_time":" TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z MAX_TIMESTAMP_LOOKAHEAD = 24 INDEXED_EXTRACTIONS = json Also, the "Z" in the timestamp is a time zone abbreviation which should be represented as "%Z" in TIME_FORMAT. ... View more

In your example, data from the index is supplemented by data from lookup files.  You can do the same with data from a data model. ... View more

Notable Events and Correlation Searches are Splunk Enterprise Security (ES) features.  While you can create an index called "notable" in Splunk Cloud (or Splunk Enterprise), you can't get the full Notables experience without ES. ... View more

Your indexes.conf files (there may be several of them)  should contain file paths that tell Splunk where to store data.  Those file paths will contain drive letters that will have to be changed to the new drive. ... View more

I would shut down Splunk and move the %SPLUNK_DB% files from D to F.  While that is happening, change all references from D to F in indexes.conf.  Then restart Splunk. ... View more

Charts require a command that produces statistics (chart, stats, timechart, etc.).  Try this index="intau_workfusion" sourcetype=workfusion.out.log host=* | rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)" | search Log_level="*" | where Process != "" | stats count by Log_level Then switch to the Visualization tab, choose the Bar Chart visualization, then select the Stacked format. ... View more

Perhaps there is an error in the bucket searches.  You may be able to find and correct it by clicking on the "Open in search" icon (magnifying glass). ... View more

The green lines make for a good regular expression, once special characters are escaped and wildcards applied. \<ORDER CANCEL="." ORDER_NAME="[^"]+" TYPE="[12]">|Creating order cancellation transaction for order [^,]+,|JSON received for product import: {"records":\[{"lgnum":"407","entitled":"[^"]+","owner":"[^"]+","product":"[^"]+" There are two ways to filter events.  The first uses a transform to find events that match a regex and send them either to an index or to nullQueue (equivalent to /dev/null).  Add the following stanzas to transforms.conf: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = \<ORDER CANCEL="." ORDER_NAME="[^"]+" TYPE="[12]">|Creating order cancellation transaction for order [^,]+,|JSON received for product import: {"records":\[{"lgnum":"407","entitled":"[^"]+","owner":"[^"]+","product":"[^"]+" DEST_KEY = queue FORMAT = indexQueue Then reference them in props.conf: [mysourcetype] TRANSFORMS-set= setnull,setparsing See https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest for the docs. The other method uses the newer INGEST_EVAL feature, also in transforms.conf. INGEST_EVAL = queue=if(match(_raw, "\<ORDER CANCEL=\".\" ORDER_NAME=\"[^\"]+\" TYPE=\"[12]\">|Creating order cancellation transaction for order [^,]+,|JSON received for product import: {\"records\":\[{\"lgnum\":\"407\",\"entitled\":\"[^\"]+\",\"owner\":\"[^\"]+\",\"product\":\"[^\"]+\""), "nullQueue", "indexQueue") See https://docs.splunk.com/Documentation/ITSI/4.17.0/Configure/transforms.conf for more. ... View more

What is the "performance issue" mentioned in the subject? The easiest way to get performance metrics from a Linux box is to install a Universal Forwarder with the Splunk Add-on For Unix and Linux app.  The app contains many inputs, including several relating to performance.  Enable the ones you need and restart the UF. ... View more

Data retention is set on a per-index basis rather than per-bucket.  Retention settings apply only to hot, warm, and cold buckets.  Splunk does not manage frozen or thawed buckets. You can find the default retention settings in $SPLUNK_HOME/etc/system/default/indexes.conf, but those settings can be overridden by another indexes.conf file.  Use btool to see the current (on-disk) config: splunk btool indexes list There's a good .conf presentation on the topic at https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj3_s6al-SAAxVxgIQIHZB8C_4QFnoECCUQAQ&url=https%3A%2F%2Fconf.splunk.com%2Ffiles%2F2017%2Fslides%2Fsplunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf&usg=AOvVaw2gaVE-_QJwICaCZc0RNQ0Z&opi=89978449   ... View more

Splunk Cloud has no visibility into your forwarders nor do the forwarders sync their configurations with Splunk Cloud instances.  You will have to re-create the connections and inputs on the Cloud SH. ... View more

This is one of several "nag" messages recently added to Splunk.  They're intended to help you make your Splunk installation more secure, but are a nuisance in sites that don't care about that extra security. The only way I know to get rid of the message is to implement the security feature it recommends (and any side effects of it).  Otherwise, just ignore the message. ... View more

Sometimes one can tell by examining the events what changes need to be made.  In that case, go to Settings->Source types, select the appropriate sourcetype, and made the needed changes. Other times it's not so easy.  One approach is to export some problematic events (raw) to a file.  Get them from the original source, if possible.  Then use the Add Data wizard to upload the file and experiment with props settings until you find the combination that works.  You then can update the app as above or put the settings into an app and upload it. ... View more

If you're on a Victoria stack then you may be able to run DBX on your Splunk Cloud search head.  It cannot be run on a Classic stack. Making DBX queries from Splunk Cloud may not work properly, however, since it's unlikely your SQL database allows connections from the Internet (which it would need to do to for Splunk Cloud to query it). ... View more

Have you tried resetting the password? ... View more

The Upgrade Readiness App ships with Splunk and so should not be upgraded separately.  That Splunk allows it to be upgraded is a mistake, IMO. You can try downgrading the app or just live with the file integrity warnings. ... View more

Splunk doesn't care what flavor of Linux you use.  As long as the kernel is a supported version you'll be fine. ... View more

How can the servers be secret if they're logged in Splunk?  😀 Splunkbase may have add-ons that help parse the logs, but they're unlikely to be listed as "secret".  Use the vendor or product name to search for relevant add-ons. Chances are, however, that you'll need to build your own add-on.  It's not hard - an add-on is just a collection of .conf files (mainly props and transforms). The process can be made easier by exporting the problematic events to a file (use "raw" mode).  Use the Add Data wizard to upload the file and experiment with settings until you find the right ones to parse the events.  Then you can copy those settings into your add-on. Upload the add-on to Splunk Cloud and see how it improves parsing.  Iterate as necessary. ... View more

What have you tried so far?  Is the sAMAccuontName field already properly extracted (the complete value is present)? ... View more

The message pretty much says what you need to do. Login to the HF and open the Search & Reporting app.  Click on the Dashboards tab then select "Integrity Check of Installed Files".  That dashboard will list the files that failed integrity checks. To fix them: 1) Undo any changes made to the files or restore them from the download file that installed them. 2) NEVER change a file in a 'default' directory. ... View more