Did you do this through the config files, or the GUI? If you did it through the config files, you will probably need to bounce the Search Head or do a debug refresh: https://answers.splunk.com/answers/102568/reload-transforms-conf-without-restarting-splunk.html ... View more

Give this a try: index=myindex myapplication UID=* IDX=* IDOK=* | bin _time span=5m | dedup _time IDX | table _time,UID,IDX,IDOK The bin will group in 5 minute chunks. Doing the dedup on both _time (a five minute chunk) and IDX will dedup on IDX within the five minute block. ... View more

Assuming you are extracting that field already, you can just filter that out in your base search. For example: index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE YOUR_FIELD!="exception" | table _time YOUR_FIELD ANOTHER_FIELD Making assumptions on your search in general, but that would be the easiest way. ... View more

Could you re-paste your sample? It seems like you may have formatted part of it as code using the 101010 button. ... View more

This is something that is usually done via professional services. One thing to consider is, using a temporary hybrid setup until your on-prem data just ages out. You would have an on-prem search head, searching both the cloud environment (new data) and the on-prem environment (old data). Once your on-prem data ages out, you can shut down the on-prem environment. Depending on your retention requirements, this is typically an easier solution and can be less costly. ... View more

Have you verified the regex works in a tool like regex101.com? ... View more

A good practice for data sources with line breaking issues out of the box, is to get a sample and ingest through the GUI. At least up to the point of creating a sourcetype (you can cancel the ingest after saving the new sourcetype). This allows you to get a preview of the data. The two things you need to get correct when ingesting data is: timestamping and linebreaking. The data preview allows you to see if Splunk is timestamping correctly and if it is linebreaking in the appropriate place. The data preview also allows you to change settings like those in the post by @harsmarvania57. You can immediately see the effects of the changes and know if you have everything correct. Once the data looks good in the preview, you can save it as a sourcetype, which you would reference in your inputs.conf. A good tool to help figure out the regex for the LINE_BREAKER is regex101.com. This isn't an answer, you already have a good one, but hopefully it is helpful information. ... View more

I'm not sure if this is helpful, but have you tried this: ... | fields backend_* OR ... | fieldsummary | fields backend_* ... View more

Try something like this: index="yourindex" sourcetype="yoursourcetype" | rex field=_raw "VALUE=\*\*\"(?<VAL>\d+\.\d+)\"\*\*" | bin span=5m _time | stats avg(VAL) as AVGVAL by _time STEP ZONE CODE | eval AVGVAL=round(AVGVAL,2) I had to do the rex because Splunk was auto-extracting **"1965.00000"** instead of just 1965.00000 for the VALUE field. If you want 5 decimal places, just change the 2 in the last line to 5. Here is a screenshot of the results of this search: ... View more

https://docs.splunk.com/Documentation/Splunk/7.1.3/Indexer/Restorearchiveddata ... View more

Are you trying to use these as the timestamp for the event, or do you simply want to extract the hour and minute into a field? If the latter, then try: eval hoursminutes=strftime(yourtimestampfield,"%H.%M") ... View more

You could use the tail command: index="windows-wmi" sourcetype="wmi:diskdrive" | table host Caption DeviceID FirmwareRevision Status | tail 1 ... View more

Take a look at this: https://docs.splunk.com/Documentation/Splunk/7.1.3/Data/Specifyinputpathswithwildcards ... View more

@deepashri_123 is correct. I think the docs make it a bit confusing on this. The only reason the indexers would need to be Windows, is if you were also ingesting locally on the indexers as well. ... View more

You can edit the permissions for any report and check off which roles have read and/or write access to that report. ... View more

Install ITSI on a single instance Install ITSI on a single Splunk Enterprise instance. In a single-instance deployment, a single Splunk Enterprise instance serves as both search head and indexer. You must install ITSI by extracting the ITSI installation package. ITSI does not support installation using the app manager in Splunk Web or using the splunk install app command at the command line. Log in to splunk.com with your Splunk.com user name and password. Download the latest Splunk IT Service Intelligence product. Stop splunk. For example: cd $SPLUNK_HOME/bin ./splunk stop Extract the ITSI installation package into $SPLUNK_HOME/etc/apps. For example: tar -xvf splunk-it-service-intelligence_.spl -C $SPLUNK_HOME/etc/apps On Windows, rename the file extension from .spl to .tgz first and use a third-party utility like 7-Zip to perform the extraction. Start splunk. For example: cd $SPLUNK_HOME/bin ./splunk start ... View more

Are you trying to install it through the GUI? ITSI needs to be installed from the command line. It contains several other app directories. ... View more

This is probably a bit greedy, but it works in regex101.com: .*\.(?<extension>[a-z]+) ... View more

Check the kernel version. Splunk support is based on the kernel version as opposed to the flavor of Linux. ... View more

Here it is: https://answers.splunk.com/answers/661506/predict-with-wildcard.html#answer-661742 This was a slightly different scenario, but it may be helpful. ... View more

When you say you created the index through the GUI, do you mean on the search head only? Or did you go into the GUI on the indexers as well? You will need to create the index on the indexers or push that out in the indexes.conf in your deployment app. ... View more