Found this: https://answers.splunk.com/answers/365914/why-are-we-seeing-duplicate-events-found-in-an-ind.html An additional incentive to update??? ... View more

I see that my xml post was broken (sorry). Can you share your xml with the offending lines. Make sure to use the 101010 (reminder to self as well). ... View more

OK, so now the question becomes what is actually doing the emailing? How are you turning this search into an email? ... View more

A bit more context here would help. How is the data being displayed. Are the lines in the raw logs now? ... ... View more

Maybe not quite what you expected but it does work: <set token="indx">*</set> License Galore all you ever wanted to know about license use <input type="time" searchWhenChanged="true" token="time"> <label>Time picker</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="radio" token="resetTokens" searchWhenChanged="true"> <label></label> <choice value="reset">Reset Inputs</choice> <choice value="retain">Retain</choice> <default>retain</default> <change> <condition value="reset"> <set token="indx">*</set> <set token="resetTokens">retain</set> </condition> </change> </input> <panel> <title>Index size</title> <chart> <title>Index sizes over time</title> <search> <query>index=_internal source=*license_usage.log type=Usage | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by idx | rename idx as Index, sum(MB) as Megabyte | sort – Megabyte</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleY.text">MB</option> <option name="charting.chart">area</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="indx">$click.name2$</set> <set token="form.resetTokens">retain</set> </drilldown> </chart> </panel> <panel> <title>Sourcetype size</title> <chart id="detail" depends="$indx$"> <title>Sourcetype detail for $indx$ index</title> <search> <query>index=_internal source=*license_usage.log type=Usage idx=$indx$ | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by st | rename st as SourceType, sum(MB) as Megabyte | sort – Megabyte</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">MB</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> </chart> </panel> ...Laurie:{) ... View more

Also your transform needs to $1::$2 And as already stated it happens at search not index time. If it MUST happen at index then you could look at using sedcmd. ...Laurie:{) ... View more

Taking from :https://answers.splunk.com/answers/185455/how-to-create-a-month-over-month-year-over-year-re.html and modifying it you could do something like: index=zscaler urlsupercat="Advanced Security" earliest=-2month@month latest=-1month@month | stats count as pre_month by urlcat | join urlcat [ index=zscaler urlsupercat="Advanced Security" earliest=-1month@month latest=@month | stats count as this_month by urlcat ] | eval month_perc=100*(this_month / pre_month) | rename urlcat as "Threat Category" | table month_perc,"Threat Category" .... You could start by creating a base search that does the combined period (remember to keep _time and just the fields you need) HTH ...Laurie:{) ... View more

You've read this: https://docs.splunk.com/Documentation/Splunk/7.2.1/Security/ConfigureSplunkforwardingtousesignedcertificates and you've created certs that require the sslPassword? The password is initially in clear text but Splunk encrypts it on first use. I created (but can't share - sorry) a shell script that checks and copies new certs into etc/auth/mydir and has the password in the clear for deployment. It restarts the forwarder so that the password is encrypted and the password can then be removed from the deployment server to minimise the time it's kept anywhere in the clear. Not ideal but possibly as good as Splunk can get it today and still be mass deployed. HTH ...Laurie:{) ... View more

http://wiki.splunk.com/Community:UseSplunkForEventCorrelation might help and/or consider using stats. You might be able to improve on this with a single stats command, but at least this should work and give you the ability to specify different time ranges per index: index=logins | stats max(_time) as lt by account | join account [ search index=door_time | stats min(_time) as ft by account | fields + ft account] | eval duration = lt-ft | table duration lt ft account Assumes that 'account' is your user name that matches in both indexes. ...Laurie:{) ... View more

Not sure what piece you're stuck on. Maybe sharing what you've tried will assist with getting a better answer. Have you looked at https://answers.splunk.com/answers/509911/what-is-the-correct-earliest-time-format-for-searc-1.html ? ...Laurie:{) ... View more

any difference between the original and it duplicate/s. i.e. for each event, how does it differ from its duplicate? Is there only 1 copy or more of each of the duplicates? ... View more

You said you looked at indextime. Did that include looking at the indextime for both copies of the same event? Pick a few events that are duplicated and look at any differences between the events. indextime, host, splunkserver... is there anything you can see as different? ...Laurie:{) ... View more

Yep - did the trick for me too. Thanks. ... View more

I don't recall ever receiving a Splunk fix. ... View more

Hi @VatsalJagani, I need to check I'm allowed to post the changes I made to predict.py That's why I haven't already done it 🙂 Cheers ...Laurie:{) ... View more

Excellent. Thanks ... View more

Hi Vince, Any chance we can get a 'beta' copy to look at ? Keen to get things moving 🙂 ...Laurie:{) ... View more

I've extended predict to allow it to take '*' as a wildcard Maybe you can too? ...Laurie:{) ... View more

If you have your columns in a 'somecategory' field and the values of the columns in a 'somecount' field that would allow you to do something like ... | timechart sum(somecount) BY somecategory | predict 10357 12745 13317 ...Laurie:{) ... View more

As you've not mentioned it, did you check that the UF installed on that machine is actually version 6? ... View more

Support ticket has been raised. ... View more

MS SQL Server 2008 R2. ... View more

Yep, that's all 🙂 Give it a whirl.. ... View more

The workaround did the trick. Many thanks. Look forward to seeing the fix come out. ...Laurie:{) ... View more