I have simple alert setup and it is supposed to trigger when there are no events. But the alert is getting triggered even when i can see the results when run the search manually in search App. But when i inspect the job and run the search from under Activity>Triggered Alerts i do not see any events. How do i rectify this issue?  I am searching the query for earliest=-11m in the alert query and my cron schedule is 4,14,24,34,44,54 * * * * Alert is created by other USER ,who has same privilege's as mine i.e. Admin ... View more

i want to remove the spaces of the leading and trailing of my field. I am trying to use trim and below Rex both are not working for me. |eval NewField=trim(OldField) | rex field=myField mode=sed "s/(^\s+)|(\s+$)//g" My data EX:(dots is to show the space) TR# CR1K901395........ BT1K901394 CT2K901398         KMK901397......... NHK901393 |eval TRIM=trim(TR#) this is throwing me an error. Cant we use TRIM function to trim the whole field? any suggestions on how can i remove the spaces of the whole field? ... View more

Hi, We have clustered environment with 4 indexers and 4 Search heads ,1 cluster master,1 deployment server and 2 HF. We are moving our servers into AZURE platform.  What configuration changes do we have to make in Splunk after migrating? What happens to indexed data in splunk after migrating to AZURE and how can i retrieve it? I could not find relevant docs on this migration. so please share any links or  docs which explains on what actions needs to be taken after migrating splunk in AZURE. Thanks! ... View more

I have converted the date field to epoch time and results obtained from the query is sorted as expected, but while clicking on the sort option in the table for the Date Field, date between 2021 and 2020 are not sorting in the ascending order. I am using Splunk 7.0 version, is this because of the instance issue? because from my query i am getting correct result only when clicked on sort icon it is not sorted properly.   ... View more

Hi, I have around 1000 events in my indexed data. I have to create a DATE dropdown which pulls and shows all the dates of CURRENT MONTH,PREVIOUS 3 MONTHS AND 1 FUTURE MONTH DATE. How do i write a query for this? P.S: My Date is not index_time/_time.It is sharepoint data which i am indexing it in splunk Thanks in Advance! Happy New year!   Query used to fetch DATE field and ProdDate is in yyyy-mm-dd format(2021-01-09) index = splunk  sourcetype = splunk-sp | spath | fields m:properties_date | rename "m:properties_date" as "ProdDate" | dedup ProdDate | eval temp=split(ProdDate,"T") | eval ProdDate=mvindex(temp, 0) |table ProdDate ... View more

HI ,i have updated inputs.conf in my deployment server. Can i restart my deployment server so that changes will get reflected. will it impact any of my UF where there will be disconnected from Deployment server and loss of data. Or can i use any command to update my inputs.conf in server?   Thanks ... View more

Hi , I wanted to know whether by clicking on the bar graph can we populate the different field values For example i have bar graph showing the index name ,but when i drilldown on the bars i need to populate the sourcetype name associated with the index shown in the bar graph. i have bar chart showing indexes . When i click on the  the bar's i want to display the sourcetype of the particural indexes. Now i am able to drilldown but i am not getting the required details i.e. source type.It is showing no results found since when clicked on the bar graph it takes the shown value .  PFB CODE: <drilldown> <set token="indexname">$click.name2$</set> </drilldown>   Query used in the second panel index=* |search sourcetype="$indexname$"|table index sourcetype Any suggestions? ... View more

How to calculate the memory used percentage for windows servers. Any suggestions?   ... View more

Hi, I want to know the volume of data present in my each application present in search head. I have the query to calculate volume according to index but i want to know the volume of data to be calculated according to application.   Any help is appreciated! ... View more

We are trying to predict the infrastructure details such as cpu memory disk utilization using ML Tool kit. To predict the next/future one day data ,how much volume of history data needs to be considered or trained. Any suggestions? Or please share any relevant docs on the same. Which is the best model/algorithm can be considered to predict the future outcome.How to test if the predicted value is correct. ... View more

Hi, My requirement is to check all the checkboxes based on the results obtained from the query. Example: When my query runs it gives the below results of sourcetype. They are displayed as checkbox options. Only first sourcetype "HR" is checked and others are unchecked. I want my query all results to be checked which i am failing to do so.  sourcetype HR LP MN I am using the below code <input type="checkbox" id="check1" token="environment" searchWhenChanged="true"> <label>Environments</label> <search> <query>index = main sourcetype = landscape earliest=-48h |dedup sourcetype | table sourcetype</query> </search> <change> <condition value="HR"> <set token="HR">HR</set> </condition> <condition> <unset token="HR"></unset> </condition> </change> <default>*</default> <initialValue>*</initialValue> <delimiter> </delimiter> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> </input> any suggestions on how i can do this ? ... View more

Hi, We have Distributed Environment and have 4 Search Heads Do we need to place inputs.conf of the website monitoring app in all the 4 Search Head Instance in the distributed Environment? Or is it enough if we can place inputs.conf in any of the one Search Head? ... View more