@muizash yes, you will need to update the datetime xml on all the Splunk endpoints. Option 1: Download the new datetime.xml and copy it to $SPLUNK_HOME/etc/. This will replace the exisiting datetime.xml file. After that you will need to restart the Splunk instance. Now this location cannot be touched by the deployment server, so you will need to push the files out using an alternative method on all your UF's. Option 2: Upgrade the Splunk version you're running across all instance. The new install has the updated datetime.xml file ... View more

@chookp post a couple of sample events to assist. ... View more

@loginsoftresearch can you post a sample data set and what model it needs to be mapped to ? Please eliminate all sensitive info. Also the method of ingestion. ... View more

@surekhasplunk Potential things to check: - the transforms that are applied to the sourcetypes, there could be issues with that if you've created custom transforms or routing of the data - SED extraction in props.conf ... View more

@mehrdad_2000 Go to Settings -> Fields and you can select the option that applies ... View more

@loginsoftresearch to begin with, you would want to understand what DataModel the JSON is most relevant too, so look into this guide for that. https://docs.splunk.com/Documentation/CIM/4.15.0/User/Howtousethesereferencetables Download and Install the Splunk CIM app on the SH or SHC: https://splunkbase.splunk.com/app/1621/ Lastly, you want to go through this and follow the details which apply: https://docs.splunk.com/Documentation/CIM/4.15.0/User/HowtouseCIM This is something I follow: Run the index=IndexName sourcetype=SourcetType search for the last 24 hours. I then write the evals / field alias in spl and check that the mapping is correct and returns all the fields. EG: eval action = if(isnull(action_success),if(isnotnull(action_failure),"failure",null()),"success") rex field=_raw Message=(?[^.]*) which would be as such in local/props.conf [SourceType] EVAL-action = if(isnull(action_success),if(isnotnull(action_failure),"failure",null()),"success") EXTRACT-signature = Message=(?[^.]*) local/eventtypes.conf [EventType] search=index=IndexName sourcetype=SourcetType tag = authentication ### note: i add the # tag reference here so its easier later on when there are many mappings local/tags.conf [eventtype=EventType] authentication = enabled add any other tags that apply Once this is complete, you would want to restart the SH(C) and run the index=IndexName sourcetype=SourcetType search to see that the fields extracted are displayed in the panel. Also make yourself familiar with tstats and how to search through the datamodels: https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Tstats Note: Before jumping into data model acceleration read this doc. https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels Some of the things to note are: the root object mapping, storage impact, acceleration and impact on searches etc. ... View more

@ashanka as such: | makeresults | eval _raw = "Type Country Reporting US reporting CAN Reporting IND COnsolidated US Consolidate CAN Consolidated IND" | multikv forceheader=1 | eval Type_new = upper(substr(Type, 0, 1)) + lower(substr(Type, 2)) | eval Type = case(match(Type_new, "Reporting"), "Reporting", match(Type_new, "Consolidate(d)?"), "Consolidated") | stats list(Country) as Country By Type This will return: ... View more

@teak421 have you enabled the input? Have you configured the indexes? Are you sending the logs to the Indexer(s)? ... View more

@umairahmad3985 unable to replicate it on Splunk7.3.4. What Splunk version are you running ? ... View more

@smelf1 please post the DM search and the DM tree structure. ... View more

why setup your own ansible when splunk has made it open source: https://github.com/splunk/splunk-ansible ... View more

@khojas02 does this give you whats needed? check from the rex command onwards | makeresults | eval _raw = "Analyst, Span A, 1049d 00h 00m B, 430d 01h 00m C, 225d 05h 00m" | multikv forceheader=1 | rex field=Span "(?<days>\d+)d\s(?<hours>\d+)h\s(?<min>\d+)m" | eval years = floor(days / 365), months = floor((days - (years * 365)) * 0.0329), days = days - ((years * 365) + (months * 30.4167)) ... View more

@adalbor need two pieces of info: 1) what is the deployment architecture? 2) Did you reload the indexers to get the new props and transforms config ? ... View more

@vikram1583 can you provide more detail about this? Maybe include an example ... View more

@rajiv_r apologies, i missed the tag. As per the Splunk docs, user doesn't have the permission to migrate or move indexes: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/User/ManageIndexes you would want to raise a Support ticket for that if you want to move all data. Alternatively, if you want to push some data across to a new index, you can create the new index and use the collect command. This will put the data into the summary index. ... View more

@anwar114 yes that can be done at index timee. You would want to update the props.conf and create a new csv sourcetype. Copy the current stanza key pair as data is being extracted correctly. The key pair you want to modify is this FIELD_QUOTE = " Update to FIELD_QUOTE = ' if you're using inputs.conf and any other .conf file or searches, you would want to update the sourcetype reference to this new sourcetype. ... View more

@rajiv_r have you seen the below ? https://answers.splunk.com/answers/709334/how-do-i-move-data-from-one-index-to-another.html ... View more

@willadams it carries out the AND operation for values of each row col, so (row0col1 AND row0col2 and row0col3 .. AND row0coln) followed by the OR operation for all the rows ((row0col1 AND row0col2 and row0col3 .. AND row0coln) OR (row1col1 AND row1col2 and row1col3 .. AND row1coln) OR (rowncol1 AND rowncol2 and rowncol3 .. AND rowncoln)) Hope that clarifies 🙂 ... View more

@anwar114 the issue is with your csv data. What you want to do is escape the quotations or remove them. So the data should be as such: field1, field2, field3, field4, field5, field6, field7 "123","EMPTY","1766 Bytes",32770: ALL_REQ:2 | CT_FLAG(32768),131680: 20(32) | CT_FLAG |MODIFIED:20000(131072),"44d5","200 bytes" OR: field1, field2, field3, field4, field5, field6, field7 "123","EMPTY","1766 Bytes",\"32770\": ALL_REQ:2 | CT_FLAG(32768),\"131680\": 20(32) | CT_FLAG |MODIFIED:20000(131072),"44d5","200 bytes" OR: field1, field2, field3, field4, field5, field6, field7 123,EMPTY,1766 Bytes,32770: ALL_REQ:2 | CT_FLAG(32768),131680: 20(32) | CT_FLAG |MODIFIED:20000(131072),44d5,200 bytes and the csv sourcetype will work as expected ... View more

The issue appears to be at the aggQueue based on the screenshot. So check if the props.conf is configured correctly for the sourcetypes. Things you want to check: - Should_Linemerge - Max_events - Time_prefix - Time_format - Datetime_config - Max_Days_Ago ... View more

@damucka yes, that can be achieved. There are three ranges available: low (green color), elevated (yellow color), severe (red color). So if you've a column that has the condition to describe the color, you can set the range. Here is an example where I've added the trigger condition to the tooltip itself: | makeresults | eval raw = "Channel1%Show1%6:00:00 PM%7:00:00 PM;Channel1%Show2%7:00:00 PM%8:00:00 PM;Channel1%Show3%8:00:00 PM%9:00:00 PM;Channel2%ShowA%5:00:00 PM%6:00:00 PM;Channel2%ShowB%6:00:00 PM%6:30:00 PM;Channel2%ShowC%6:30:00 PM%8:00:00 PM;Channel3%ShowA%7:00:00 PM%8:00:00 PM;Channel3%ShowB%8:00:00 PM%8:30:00 PM;Channel3%ShowC%8:30:00 PM%9:00:00 PM" | makemv raw delim=";" | mvexpand raw | rex field=raw "(?<Channel>[^\%]+)%(?<Show>[^\%]+)%(?<Start_Time>[^\%]+)%(?<Finish_Time>[^\%]+)" | eval time_1 = strptime(Start_Time, "%H:%M:%S %p") | eval time_2 = strptime(Finish_Time, "%H:%M:%S %p") | eval duration = "Duration = ".round((time_2 - time_1)/3600, 1)." hr" | eval group = Channel, label = Show, start = time_1, end = time_2, tooltip = Show."\n".duration | eval tooltip = if(group == "Channel1", tooltip + "\n" + "Restart phase not running", tooltip) | eval range = if(match(tooltip, ".*Restart phase not running"), "elevated", "low") | makemv tooltip delim="\n" | table group, label, start, end, tooltip, range alternatively, you can set the range as the below, which will only highlight the restart phase: | eval range = case(match(tooltip, ".*Restart phase not running"), "elevated") ... View more