In Monitoring Console in our Master, we have And I open it in search and got this query | rest splunk_server=test43 /services/server/introspection/queues | eval current_fill_perc = round(current_size_bytes / max_size_bytes * 100, 0) | fields title, current_fill_perc | search title="parsingQueue.*" OR title="aggQueue.*" OR title="typingQueue.*" OR title="indexQueue.*" | rex field=title "(?<queue_name>^\w+)\.(?<pipeline_number>\d+)" | chart values(current_fill_perc) over pipeline_number by queue_name | fields pipeline_number, parsingQueue, aggQueue, typingQueue, indexQueue | rename pipeline_number as "Pipeline Number", parsingQueue as "Parsing Queue Fill Ratio (%)", aggQueue as "Aggregator Queue Fill Ratio (%)", typingQueue as "Typing Queue Fill Ratio (%)", indexQueue as "Index Queue Fill Ratio (%)" I want to create a dashboard for some members that don't have access in our Master server to see, but when I run that search in our Search head, it produce no result. So there is other way to show it in our SH? ... View more

I'm trying to troubleshoot a Connection that I made in DBConnect app, it show the error as above. I don't know if the error was on my end and my input or the info I received. Most of the answer I searched for was about JDBC but that was automate in DBConnect. So what should I do in this situation? Is it on my end or should I contact the DB owner or the networking department in my org? ... View more

Hello, I have query that produce a table like this: Quantity Company 4 Company_A 63 Company_B 13 Company_C   The requirement that I have to send each company their own data with the attached csv with their name, for example "report_for_Company_A.csv" , "report_for_Company_B.csv". Company A will receive their row of data with their attached file name. I try to use     |<my search that produce the table> |eval myCustomFileName = "Report_for_" + Company |ouputcsv $myCustomFileName$.csv     It does have the field myCustomFileName correct but the file output was name $myCustomFileName$.csv. How do I do it? ... View more

Hello, When I ran       index=_audit NOT user="splunk-system-user" |stats count by action       I find that accelerate_search and search is fairy high. So I was wandering which is panel search and which is adhoc search, which is adhoc search, which is alert (schedule_search). We need to create a report about performance. ... View more

Hello, I'm troubleshooting a possible problems with the dbconnect app. We setup a dbinput that indexing with 90 second frequency, raising column by time. We have to index these data fairly frequently for monitoring. At around 4PM, monitoring team told me that data has stop indexing, I check indexing log and found no bug The log said input_mode=tail events=0, and repeat in 30 minutes until we have normal index log with rising column check point again. I checked with SQL and the we do have data in between those time.So I want to pinpoint the root problems so we don't encounter this again. Is this the problems with networking, oracleBD, or is this from splunk (I highly doubt it because I don't do anything and it continue indexing 30 min after) ... View more

I want to make a report about how many alerts fired in a day. I saw in the job inspection I want all of these info, owner, apps, event, size and runtime. It's to determine how many alert overlapping each other, how many times that alert triggered. Prefer in SPL. Basically, I want for these information to help me make a detail report about alerts in our system. ... View more

Hello, We just got our application pentest on Splunk, and there are many issues that pop up. These issues are: 1. SQL Injection ( 11299) 2. Insecure Transport ( 4722 ) 3. Credential Management: Sensitive Information Disclosure ( 10551) 4. Often Misused: Login ( 10595 ) 5. Password Management: Weak Password Policy ( 11496 ) 6. Often Misused: HTTP Method Override ( 11534 ) 7. Cookie Security: Persistent Cookie ( 4728 ) 8. Privacy Violation: HTTP GET ( 10965 ) 9. HTML5: Overly Permissive Message Posting Policy ( 11347 ) 10. HTTP Verb Tampering ( 11501 ) 11. Path Manipulation: Special Characters ( 11699 ) 3, 4, 5 and 7 I can manage but the others I don't know how to fix, because I'm only familiar with Splunk Web interface. I wanted to ask: 1. If I'm enable SSL and switch my Splunk web url from http -> https, can we fix HTTP relate issues which is 6, 8 10. 2. How can I fix other issues, they told us to screenshot evidences as well if we can't fix them, where do I look for it? Thank you in advance. ... View more

Hello, We have a dbinput that pull in data from an Oracle database. Yesterday, there was some problems with our indexer so we lost a bit of data in that time. I know that I can change the rising checkpoint value to yesterday but it will reindex data till that point to now. I want to know are there any other way to reindex those missing data in the pass without delete it all? Edit: I try the delete and reindex all by changing the tail_rising_column_checkpoint_value to the epoch time in the pass but when it's start it only start indexing from the point that I refresh please help ... View more