Hi @Glace , could you please advise whether this line is one event or its part of an event when you are trying to ingest the log file in Splunk? ... View more

Hi @yshen , the part where I hardcoded is just a run anywhere example. Please only use the highlighted in violet color part with your existing fields in the log for both the questions.   ... View more

Hi @cdstealer , could you please share your props? Also, can you check using below query on SH that your extractions shows up ? | rest splunk_server=local servicesNS/nobody/<your-app_name>/configs/conf-props/ | rex field=id "servicesNS\/nobody\/(?<app>.+?)\/" | where app="<your-app_name>" | fields - eai:* SEGMENTATION* | fields id,title, sourcetype, updated, disabled *, FIELDALIAS-* | search title=<sourcetype name> | transpose 1 column_name=setting | rename "row 1" as value | search value != "" | eval value=case(value=1,"true", value=0,"false",1=1,value) | eval stanzas = setting +" = "+value | stats LIST(stanzas) as Stanza ... View more

Hi @NS , you can use epoch time values to compare the current time with created_time in the search  Below is a run anywhere example  | makeresults | eval created_time="2020-09-02 07:44:55,2020-08-28 15:27:36" | eval created_time = split(created_time,",") | mvexpand created_time | eval created_time_epoch=strptime(created_time,"%Y-%m-%d %H:%M:%S") | eval lower_time=relative_time(_time,"-1d@d"),upper_time=relative_time(_time,"-1d@d+24h") | where created_time_epoch > lower_time AND created_time_epoch < upper_time ... View more

Hi @mdzmuran , yes it can be integrated with git. You can work on your own solution for this integration or you can try this app if it suits your need https://splunkbase.splunk.com/app/4182/ You can also refer this document for information  https://conf.splunk.com/session/2014/conf2014_VladimirHad_FirstData_Deploying.pdf   ... View more

Hi @sarit_s , the key for the limit you are seeing is max_queries_per_batch , can you add this key in the kvstore stanza with a value greater than the value for which you are seeing the error and see it that fixes? ... View more

Hi @splunkkid , I thnk you are facing duplicate field extractions, as mentioned in this post, please have a look.   https://community.splunk.com/t5/Getting-Data-In/Why-is-my-sourcetype-configuration-for-JSON-events-with-INDEXED/td-p/188551 ... View more

hi @splunkkid , could you please advise if these fields are part of json logs? Also, where have you placed the props.conf stanza for these events? ... View more

hi @rambeeram , is there any event log when a host begins to listen on suspicious ports in your Splunk logs? ... View more

Hi @codedtech you can use chart command as below after the case statement, in place of values() function you can use any other function that suits your requirement.   | chart values(utilization) over RAG by Class hope this helps, please upvote or mark my previous post as solution is that answered your original question. ... View more

Hi @andrewtrobec , on the receiving dashboard you can use javascript to decode the encode url and reload the page.  ... View more

Hi @manikanthkoti , ideally while writing to summary index whatever fileds appear in the results are the indexed fields. Does your search returns the fields in the result that you are interested to see in summary index? ... View more

Hello @inayath_khanin , you can use a smaller time range when reviewing notable events on Incident Review, which reduces the number of events on the Incident Review dashboard to less than 1000. 1000 is the default value of max_events_per_bucket  for more details refer splunk documentation: https://docs.splunk.com/Documentation/ES/6.2.0/Admin/CustomizeIR ... View more

Hi @aditsss , you can use tokens for this, below might not be the best way to do it, but it will work for the multiselect dropdown Assuming you have 20 values in the multiselect dropdown, for each value in the dropdown  create tokens in init <init> <set token="matcher1">Force</set> <set token="matcher2">Merchant</set> . . . </init> Then, in the multiselct dropdown input, write condition as  <input type="multiselect" token="name" searchWhenChanged="true"> <label> Name</label> <choice value="*">All Name</choice> <search> <query>|inputlookup abc.csv|table FolderName</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <fieldForLabel>FolderName</fieldForLabel> <fieldForValue>FolderName</fieldForValue> <prefix>(</prefix> <valuePrefix>FolderName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <initialValue>*</initialValue> <default>*</default> <change> <condition match="match($name$,$matcher1$"> <set token="force"></set> <unset token="merchant"></unset> <unset token="dropdown value"></unset> .... .... till all 19 tokens are unset for other than Force option </condition> <condition match="match($name$,$matcher2$"> <set token="merchant"></set> <unset token="force"></unset> <unset token="dropdown value"></unset> .... .... till all 19 tokens are unset for other than Merchant option </condition> ..... .... .... similar condition for other dropdown options </change> </input> now, in the respective panels use the respective tokens in depends like <row depends="$force$"> <panel> <title> Report for Force</title> <chart> <search> <query>index=abc sourcetype="xyz" FolderName=force $name$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="trellis.splitBy">FolderName</option> </chart> </panel> </row> <row depends="$merchant$"> <panel> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" FolderName=merchant $name$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="trellis.splitBy">FolderName</option> </chart> </panel> </row> Let me know if any question.   ... View more

hi @codedtech , try this | eval RAG=case(Class='DB' AND Utilization >= 62, "Red", Utilization >= 50, "Yellow", Utilization < 40, "Green",1=1,"Unmatched") ... View more

Thanks @dkgs, I have not used Splunk Cloud yet so I am not sure if the approach would be same as Splunk Enterprise. Could you check if below link is helpful? https://docs.splunk.com/Documentation/SCS/current/Viz/Addimages     ... View more

Hi @boromir , since you mentioned your environment has realtime searches and they run on time, there is a possibility that some of your normal alerts might be getting skipped. Please check if the alert which is missing schedule sometimes is getting skipped using below query: index=_internal sourcetype=scheduler status="skipped"  savedsearch_name="<name of the alert which is not firing always>" Also, to get a bigger picture if your environment is facing skipped searches issue, you can run below search : index=_internal sourcetype=scheduler (status="success" OR status="skipped" OR status="continued") | top status Let me know what you find out by this test. ... View more

hi @dkgs , you can use css to do so, add a hidden row for css like  <row> <panel depends="$alwaysHideHTMLStyle$"> <title>`for css(do not delete)</title> <html> <style> body{margin-bottom: 150px;background: #0f1b1f !important;} .dashboard-body{background-color:#0f1b1f!important; font-weight:bold!important} </style> </html> </panel> </row> ... View more

hi @firefox95 , if you are using this search for a report , please use below  index="_internal" sourcetype=dbx_job_metrics input_name=* connection="*" | eval event_time=strftime(_time,"%m/%d/%y %H:%M:%S") | join type=left connection [search index="_internal" sourcetype=dbx_server ERROR | rex field=_raw "^(?<error>.*)\n?" | rex field=error "/api/connections/(?<connection>[^/]+)"] | stats latest(event_time) as event_time latest(host) as HF latest(connection) as connection latest(status) as status latest(error) as error by input_name | sort - status ... View more

Hi @splunkcol , you can also use allow_skew feature to help in this situation - searches which are not high priority can be skewed to avoid impacting the schedule of high priority searches. We also faced the high skipped and continued searches issue and allow_skew worked like a charm. Please read the details on what it does and hot it works to understand if this is something which can help you further. https://docs.splunk.com/Documentation/Splunk/8.0.5/Report/Skewscheduledreportstarttimes   Nisha ... View more

@MohanPalisetty  please refer https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Aboutdatasets#Dataset_types_and_usage ... View more