Hello @PickleRick the other 4 points you mentioned was of no use, which is why it's not included in the answer. Couple of points -  1. The question author have mentioned - " I'm fairly new to Splunk and I'm still learning how to set things up so as many details as possible would be helpful." - Which is why the answer mentions about having everything at one place and monitor it later - which is usual practice. 2. Community answer initiate a "thread" where further discussion can be in place about what and how to achieve the solution 3. The question also mentions "I believe the process is to have the printers redirect their logs to the print server to a specific folder, then add that folder to the list of logs being reported in the Splunk forwarder. Does that sound correct?" - which is the one of the best way to monitor the logs from one place. 4. It's not copy-pasting answer, it's about taking a reference -> looking over authenticity -> Updating it as required and sharing with community. One could literary ask each and every Splunk Community question over GPT and paste the answers - but that's not being happened. We as a community wants to use new tools along with making sure whatever we are posting is authentic and actually helps the ones who posts here 🙂 ... View more

Hello, Just checking through if the issue was resolved or you have any further questions?  ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @splunkreal, Just checking through if the issue was resolved or you have any further questions? If not, can you please accept the answer, so anyone in the future having the same question can get the solution quickly? ... View more

Hello @maverick27 sort should work in that case right? ie. -  | sort GroupNum S_no ... View more

Hello @SplunkDash, Can you please check below -  | makeresults | eval _raw="accid,nameA,addressA,cellA 002,test1,tadd1,1234 003,test2,tadd2,1256 003,test2,tadd2,5674 004,test3,tadd3,2345 005,test4,tadd4,4567 006,test5,tadd5,7800 006,test5,tadd5,9900" | multikv forceheader=1 | eval sourcetype="sourcetypeA" | append [| makeresults | eval _raw="accid,nameB,addressB,cellB 002,test1,tadd1,1234 003,test2,tadd2,5674 004,test3,tadd3,2345 005,test4,tadd3,4567 006,test5,tadd5,9900" | multikv forceheader=1 | eval sourcetype="sourcetypeB" ] | kv | stats values(*) as * by accid | where mvcount(nameA) != mvcount(nameB) OR mvcount(addressA) != mvcount(addressB) OR mvcount(cellA) != mvcount(cellB)   Please let me know if you have any questions for the above. Please accept the solution and hit Karma, if this helps! ... View more

Hello @VashisthaPandya, Do you really want to have a "real-real" traffic or dummy would work? Because you can generate dummy Windows EventCode traffic through EventGen (https://splunkbase.splunk.com/app/1924) and deploy it and focus on writing effective search query. ... View more

Hello @ezmo1982 , Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @short_cat, I don't think it's possible. I tried with makemv as well, something like -  | makeresults | eval message = "This is line 1.\nThis is line 2.\nThis is line 3." | makemv message delim="\n" But it's not sending the message as expected and just considering first line as below screenshot -  I would suggest checking with the project contributors over GitHub - https://github.com/splunk/slack-alerts 🙂 ... View more

Hello @viktoriiants, How about sorting it by 'Session count' before date desc? ... View more

Yes, what you're describing is possible and it's a common approach to collect logs from devices that can't directly forward logs to Splunk. Here's a high-level overview of the steps involved: Configure Printers to Send Logs to Print Server: You'll need to configure your printers to send their logs to a specific location on the print server. This might involve setting up syslog or other logging configurations on the printers themselves to point to the print server's IP address and designate a specific directory for log files. Set Up a Log Forwarder on Print Server: On the print server, you'll need to set up a log forwarder to monitor the directory where the printers are sending their logs. This can be done using Splunk Universal Forwarder or any other log forwarding mechanism suitable for your environment (like syslog-ng). Configure Splunk Forwarder to Monitor Log Directory: Once the print server is receiving logs from the printers, you'll need to configure the Splunk forwarder on the print server to monitor the directory where the logs are being received. This involves adding a new monitor stanza in the inputs.conf file of the Splunk forwarder. Verify and Test Configuration: After configuring everything, you'll need to verify that logs are being received by the print server from the printers and that the Splunk forwarder on the print server is successfully forwarding those logs to your Splunk indexer or another forwarder. In a nutshell, the idea to have everything available at one place and monitor instead of onboarding / installing TA individually on each host.   Please accept the solution and hit Karma, if this helps! ... View more

Hello @aydinmo This could be because of Data Model Acceleration Enforcement. What it does is, even if you turn DMA On/Off - it will enforce the default behaviour. Can you please check the configurations from Settings -> Data Model Acceleration Enforcement Settings and Enable / Disable the default behaviour as required. Below screenshot for your reference -      Here is the Splunk Doc for your reference - https://docs.splunk.com/Documentation/ES/7.3.0/Install/Datamodels#Data_model_acceleration_enforcement   Please accept the solution and hit Karma, if this helps! ... View more

Can you please try appending below -  | makemv delim="," allowempty=t CmdArgAV   Please accept the solution and hit Karma, if this helps! ... View more

Seems fairly simple / basic configurations. I would suggest raising Support case to get this troubleshot and fixed. @isoutamo thoughts? ... View more

Perfect, I believe it would be a fair step to do this to avoid confusion for multiple stanzas / parameters. I have voted the idea 🙂 ... View more

Hello @MVK1 Can you please share some sample event or an example along with expected results to understand the query better. ... View more

Hello @optsplunk I would suggest you having this available as Idea under https://ideas.splunk.com/ for the Splunk Product team to look over 🙂 ... View more

Would you mind sharing the serverclass.conf file? ... View more

Hello @tlmayes, How are you whitelisting the hosts? Do you just want to use this nice feature of filtering everything by the OS type? Screenshot below -      With the above way, you can create 2 separate server classes for Windows and Linux and whitelist all the hosts. Please accept the solution and hit Karma, if this helps! ... View more

Oh we will need to add max_match=0 in rex. Example below -  | rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]" | rex field=CmdSet max_match=0 "CmdArgAV=(?<CmdArgAV>[^\s]+)" Can you please have a check and me know how it goes? ... View more

Hello @doeboy where are you firing the command (on which instance)? The command you mentioned "./splunk show cluster-bundle-status" is meant for Cluster Manager and not for Peers. Here is the Splunk Doc for your reference - https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Updatepeerconfigurations#Use_the_CLI_to_view_the_status_of_the_bundle_push  It feels like you are trying to run the command on Indexer Peers. Can you please run on Cluster Manager and see if you are able to view the status as expected?   Please accept the solution and hit Karma, if this helps! ... View more

Hello @sushraw, Can you please try below -  | rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]" | rex field=CmdSet "CmdArgAV=(?<CmdArgAV>[^\s]+)"   Please accept the solution and hit Karma, if this helps!  ... View more