Licensing is not a matter for Support.  Contact your account team or Splunk Sales. ... View more

Please elaborate on your use case.  What sort of data? What have you tried?  How did that work out for you? ... View more

Please be more specific.  What sessions?  What defines the beginning and end of the session? Be aware that some "sessions" may be indeterminate.   For example, web-based services (like Splunk) may have login events, but no logoff events that would establish a session. ... View more

How many events are in that sample?  My sandbox finds 3 using your props.conf settings. ... View more

Have you verified the "lookup_requirement_items" macro exists and that you have access to it? ... View more

Nothing wrong with those settings, although it's recommended to use SHOULD_LINEMERGE=false with LINE_BREAKER.  Do the indexer/HF and search head use the same props?  If the SH has KV_MODE=json then fields will be duplicated. ... View more

Please share the props.conf stanza for that sourcetype. How is the timestamp different from _time? ... View more

As I stated in my first reply (perhaps not so well), the REST commands only report the *current* state, not past states. To know what changed in the past 7 days, you have to save the CS list today then wait 7 days and get a new list.  The difference is what changed. ... View more

Computers aren't random so there must be something different about the data that is causing different behavior. Perhaps spaces are inconsistent. LINE_BREAKER = \'tags\':\s*\[[\w\W].*\}(,)\s*\{\'id\': If you share sanitized samples of events that are not breaking properly then we may be able to find a better regex. ... View more

We only can fetch the current list of CSs.  To know which have been disabled recently, you'll have to keep a list of them (in a lookup, for example) and compare the current list to the saved list. You may be able to examine the configtracker logs to see which searches have been disabled recently.  This should get you started by providing a list of newly-disabled saved searches.  I'll leave it to you to figure out which are correlation searches and which are normal searches. index=_configtracker "data.changes{}.properties{}.name"="disabled" ("data.changes{}.properties{}.old_value"="*" OR "data.changes{}.properties{}.old_value"="false") ("data.changes{}.properties{}.new_value"="1" OR "data.changes{}.properties{}.new_value"="true") "data.changes{}.stanza"!="feature:*" "data.path"="*savedsearches.conf" ... View more

The first step is to have your collaboration tools log file transfers to Splunk.  Are they doing that? ... View more

To trim the event at index-time, use SEDCMD in props.conf SEDCMD-trimReason = s/.*(; Refusal Reason.*)/\1/ To trim it at search time, try this | rex mode=sed "s/.*(; Refusal Reason.*)/\1/" ... View more

As always when changing frozenTimePeriodInSecs, make sure you have the correct value.  Leaving out a digit or doing the maths wrong may result in unintended data deletion. That said, you have the right idea.  Change the setting on the Cluster Manager and push the bundle.  The indexers will then freeze any buckets that have no data newer than the new frozenTimePeriodInSecs value. ... View more

The LINE_BREAKER setting requires a capture group.  The contents of the capture group will be replaced with an event break.  Try this LINE_BREAKER = "tags":\[[\w\W].*\}(,)\{"id": ... View more

Manually reschedule searches so fewer of them run at the same time. ... View more

The standard form for the HEC URI in Splunk Cloud Platform free trials is: https://http-inputs-<host>.splunkcloud.com:8088/<endpoint See https://docs.splunk.com/Documentation/Splunk/8.2.4/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector_on_Splunk_Cloud_Platform ... View more

You can use REST to get a list of scheduled searches and their scheduled times. This query is derived from the Extended Search Reporting dashboard by dpaper at https://github.com/dpaper-splunk/public/blob/master/dashboards/extended_search_reporting.xml.  It sorts searches by their scheduled times so you can see which ones run at the same time. | rest /servicesNS/-/-/saved/searches splunk_server=local search="is_scheduled=1" search="disabled=0" earliest_time=-1h@m latest_time=now timeout=0 | table title cron_schedule scheduled_times | mvexpand scheduled_times | rename scheduled_times as _time | sort + _time   ... View more

Send email to [email protected] ... View more

Timestamp recognition is done by the parsing process, but the TZ setting comes from the UF.  It's how an indexer in one time zone can correctly process events coming from forwarders in many other time zones.  The UF is saying "hey! these times are in my time zone (PDT) not yours". ... View more

DATETIME_CONFIG and TZ are two separate settings and can co-exist.  They can be in same app. ... View more

Interesting that firstTime is quoted.  I don't see that in my tests.  Not sure what to do about that. ... View more