Hi @gcusello , Can you please help me to design a Splunk query to show whether a particular user has been coming into the office at Mascot (and/ or Erskine Park), or otherwise working from home (or elsewhere). I'd like to structure the results to show a table listing logon time and IP address - like this: Workstation    Last Login          User 10.11.12.13    15-11-01 10:00:00   user1 10.12.13.14    15-11-01 15:34:02 Regards, Rahul   ... View more

Hi , I want to set up an alert when our daily volume license usage reaches/crosses 80%. Can someone help me with this. Regards, Rahul ... View more

Hi @gcusello , We have an app "Splunk for Netxpress"  when scanning through "Splunk Platform Upgrade Readiness App" we are getting following error. Can you please help me to get rid of this.   Regards, Rahul Gupta ... View more

Hi, Can someone please help me with this? The percentage of non high priority searches skipped (73%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=759. Total skipped Searches=559 Regrads, Rahul ... View more

Hi @gcusello , We are planning to upgrade our Splunk environment from 7.1.x(current version) to 8.1 version. We have single-instance Splunk environment. Just read in one of the doc that it needs to be in three following phases. But could not find steps/commands to upgrade it. Backup Upgradation Testing We have a search head ( axxxxxhd01 ), Indexer ( xxxxxhd01 ) and a forwarder ( xxxxxfw01). Can you please guide us on upgrading to version 8.1 on Unix.? (Commands) Do we need to upgrade all i.e SH, Indexer and Forwarder, If yes what should be sequence to upgrade it. Regards, Rahul ... View more

Hi @gcusello , We've observed slow Splunk indexing in one webMethods servers (aexxxxxx) causing certain testcases to fail. Normally indexing completes in 1-2 seconds. But on some servers it takes much longer (upto 2 minutes).       Could you please help me with this. Regards, Rahul     ... View more

Hi @gcusello , We are getting an error  "[aapxxxx01] Streamed search execute failed because: Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK." I checked our daily usage limit and we have been violating our daily usage(62 GB)  limit from one week.     Could you please help to fix this. ... View more

Hi  , I'm trying to disable an alert but while doing so I'm getting an error. can you please help in this.   Please note that I am not the owner of this alert. Is it possible that because of this I'm unable to disable it?   Could not find object id=WMS WK: Auto Wave Status Has Changed Regards, Rahul   ... View more