Once the new member is added to the cluster it will get its configs from the SHC Deployer and get updates from the Captain.  Those configs should include CM/peer info so no additional steps are needed. ... View more

Thanks for sharing the events. You *are* collecting both values, but you apparently you are unhappy with how the values are presented.  Please describe or provide a mock-up of how you would like the values displayed and we'll try to find a way to accomplish that. ... View more

The depends option can be used on the input, row, panel, search, and visualization elements to control when the element is displayed.  The dashboard element cannot have a depends option. There can be only one <dashboard> element in a dashboard so the idea of merging several dashboards into one will require refactoring of them.  Consider instead using a Navigation menu to allow the user to select which dashboard to view. ... View more

What do you want the output to look like? Please re-share the raw events. ... View more

The first two are nearly equivalent with the only difference being whether or not ingestion license is charged.  There is nothing "supposed" about the stash sourcetype not incurring license usage.  It's documented at https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Collect#Syntax:~:text=By%20specifying%20a%20sourcetype%20outside%20of%20stash%2C%20you%20will%20incur%20license%20usage. Unlike collect, the sendalert command does not write to an index.  As the command name implies, it sends an alert.  While it may be possible, I've never encountered an alert that writes to an index. FTR, the collect command can write to any event index to which you have access.  It does not have to be a summary index.  Technically, all event indexes are the same, whether summary or not.   ... View more

What you've experienced is normal.  A data model can display only what is in the DM, just like a index search can display only what is in the index. Combining data from a DM and an index (or multiple DMs or indexes) is called a correlation and is one of Splunk's reasons for being.  Use the Web.user field to pull identity information. ... View more

When buckets age out and are frozen (deleted) then disk space will be restored.  The buckets need to be at least 1.5 years old before they will be deleted, however, given the frozenTimePeriodInSecs setting. Buckets also will be deleted as needed to stay within the maxTotalDataSizeMB setting, but it may take a long time to fill 4PB (depending on your ingest rate). You may want to confirm the settings are appropriate for the index. ... View more

I've experienced the same thing and not just with Splunk.  Some web sites have the same behavior.  It seems like opening in a new tab opens the *current* page in that tab and does not apply the clicked field.  I suspect there is little we can do about this. ... View more

I explained why PAGE_ID are not in the results and offered one way to include it. The original query already includes the specified search string (not a subsearch).  How is it not meeting expectations? ... View more

For security, Splunk restricts where it will write CSV files.  Perhaps you can set up a daemon to copy the files to the shared directory. ... View more

My apologies.  I recalled a selector where one could choose the terminal emulation, but I must have been thinking of a different program. The setting in question is "Terminal-type string" in Connection->Data.  Enter a value from your system's termcap or terminfo file for a terminal type that does not support ANSI sequences.  Your Linux system admin should be able to assist with the choice. ... View more

To convert textual dates from one format to another requires both strptime and strftime. | eval outputdates=if(match(outputdates,"\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d"), outputdates, strftime(strptime(outputdates, "%d-%m-%Y %H:%M:%S"), "%Y-%m-%d %H:%M:%S")) Because strptime will return null if the input doesn't match the specified format, we use if to test for the format we want to convert. ... View more

Probably none of those.  Go to the Terminal setting and choose an emulation that does not support ANSI character sequences.  Be aware that different emulators have varying (or sometime no) support for applications that write to random screen locations (like full-screen editors and programs like top). ... View more

The rex commands need to have expressions in the capture groups.  Also, and perhaps more important, the regular expression used in rex must match the data before Splunk will extract any fields.  In the sample event, each key=value pair is separated by a comma and space, but the regex only looks for a comma.  Additionally, the regexes do not account for intervening key=value pairs that are not extracted - these must still match to extract fields. The final reason why you're getting only one fileName value is the appendcols command is being asked to add column names that already exist (busDate, fileName, TotalClosingBalance).  It won't do that.  It will either keep the existing fields or replace them, but it won't duplicate them.  See https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Appendcols#Optional_arguments See this run-anywhere example of a query that works, but not produce the exact desired results. | makeresults | eval _raw="2023-08-04 10:06:12.750 [INFO ] [Thread-3] AssociationProcessor - compareTransformStatsData : statisticData: StatisticData [selectedDataSet=0, rejectedDataSet=0, totalOutputRecords=17897259, totalInputRecords=0, fileSequenceNum=0, fileHeaderBusDt=null, busDt=08/03/2023, fileName=SETTLEMENT_TRANSFORM_MERGE, totalAchCurrOutstBalAmt=0.0, totalAchBalLastStmtAmt=0.0, totalClosingBal=8.787189909105E10, sourceName=null, version=1, associationStats={}] ---- controlFileData: ControlFileData [fileName=SETTLEMENT_TRANSFORM_ASSOCIATION, busDate=08/03/2023, fileSequenceNum=0, totalBalanceLastStmt=0.0, totalCurrentOutstBal=0.0, totalRecordsWritten=17897259, totalRecords=0, totalClosingBal=8.787189909105E10]" | rex " AssociationProcessor - compareTransformStatsData : statisticData: StatisticData .+? totalOutputRecords=(?<totalOutputRecords>[^,]+),.*?busDt=(?<busDt>[^,]+), fileName=(?<fileName>[^,]+),.*?totalClosingBal=(?<totalClosingBal>[^,]+)" | eval TotalClosingBalance=tonumber(mvindex(split(totalClosingBal,"E"),0)) * pow(10,tonumber(mvindex(split(totalClosingBal,"E"),1))) | table busDt fileName totalOutputRecords TotalClosingBalance | sort busDt | appendcols [ | makeresults | eval _raw="2023-08-04 10:06:12.750 [INFO ] [Thread-3] AssociationProcessor - compareTransformStatsData : statisticData: StatisticData [selectedDataSet=0, rejectedDataSet=0, totalOutputRecords=17897259, totalInputRecords=0, fileSequenceNum=0, fileHeaderBusDt=null, busDt=08/03/2023, fileName=SETTLEMENT_TRANSFORM_MERGE, totalAchCurrOutstBalAmt=0.0, totalAchBalLastStmtAmt=0.0, totalClosingBal=8.787189909105E10, sourceName=null, version=1, associationStats={}] ---- controlFileData: ControlFileData [fileName=SETTLEMENT_TRANSFORM_ASSOCIATION, busDate=08/03/2023, fileSequenceNum=0, totalBalanceLastStmt=0.0, totalCurrentOutstBal=0.0, totalRecordsWritten=17897259, totalRecords=0, totalClosingBal=8.787189909105E10]" | rex " associationStats={}] ---- controlFileData: ControlFileData \[fileName=(?<fileName2>[^,]+), busDate=(?<busDate2>[^,]+), fileSequenceNum=(?<fileSequenceNum>[^,]+),.*?totalRecordsWritten=(?<totalRecordsWritten>[^,]+), totalRecords=(?<totalRecords>[^,]+), totalClosingBal=(?<totalClosingBal2>[^\]]+)" | eval TotalClosingBalance=tonumber(mvindex(split(totalClosingBal,"E"),0)) * pow(10,tonumber(mvindex(split(totalClosingBal,"E"),1))) | table busDate2 fileName2 totalRecordsWritten TotalClosingBalance2] | sort busDt   ... View more

I still do not see a timestamp in the events.  Splunk has assigned a value to _time for each event, but that does not mean the raw data contains a time. ... View more

I second what @PickleRick said.  There isn't really a concept of "next" in Splunk.  Events return in (roughly) time order based on the search criteria.  Depending on how the data arrived in the indexers, events from multiple sources or hosts could be interleaved.  The immediately next event could be unrelated to the "word" event. Tell us more the use case and perhaps we can come with another solution. ... View more

Short answer: you can't. If Splunk didn't write it then they won't support it.  Even some apps written by Splunk employees are not supported. I suppose there may be cases where a vendor or partner wrote a significant app that Splunk eventually assumed support for, but you probably don't have the track record to do that. ... View more

The PAGE_ID field is not available to the table command because it was removed by the stats command.  The only fields available at to table are sla, PAGE_CATEGORY, totalcount, and countofpases.  You could make PAGE_ID available by including it in the stats command. PAGE_ID=* | where PAGE_ID=DGEFH OR PAGE_ID =RGHJH NOT NUM_OF_MONTHS_RUN>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4 | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | eval timeinsecs= round((TRAN_TIME_MS/1000),2) | stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY, PAGE_ID | eval sla= (countofpases/totalcount)*100 | table PAGEID sla   ... View more

Try using LINE_BREAKER to break events before "SUBJECT" (the apparent start of an event). [MY-SOURCETYPE] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+)SUBJECT NO_BINARY_CHECK = true category = custom pulldown_type = 1 TIME_FORMAT = %Y-%m-%d_%H:%M:%S_%p SHOULD_LINEMERGE = false disabled = false You have TIME_FORMAT specified, but I don't see TIME_PREFIX.  They usually go together.  Nor do I see a timestamp in the sample events so perhaps TIME_FORMAT is not needed.   ... View more