Hi @nabeel652 could you please share the steps ?  ... View more

Hi @csutherland504, Are you currently using ES ? Usually data enrichment happens on search time with automatic lookup, so have a look at your automatic lookup configuration for the specific sourcetype that you're looking for. This can help you better understand where the extra fields you're seeing are coming from. You can find details about automatic lookups here : https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/DefineanautomaticlookupinSplunkWeb Cheers, David ... View more

Hi @anoopambli, You can add the following to the script to suppress the warnings. import urllib3 urllib3.disable_warnings() Cheers, David ... View more

Yes its possible to get the % increase and decrease, you can do that using autoregress command which will allow you to see both the data from now with the previous value on the same line, from there you can run an eval command to get the % change. Reference for autoregress can be found here : https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Autoregress ... View more

@jadengoho, then in that case next time you face the issue please try hitting the _bump or refresh endpoint: mysplunkhost:8000/en-US/debug/refresh or mysplunkhost:8000/en-US/_bump And make sure you didn't set up splunk on deep thought. This could be why you're getting 42. @MuS can confirm. ... View more

@jadengoho, that's weird ... this "sometime the table shows but most of the time it's not showing" is most of the times due to cache... What browser are you using ? And could you try to change it ? ... View more

@jadengoho, have you done any upgrades for ES recently ? Or have you changed any permissions for your user recently ? There is a known issue for ES 5.3.0 where mis-configured roles might lead to the incident review page not loading : https://docs.splunk.com/Documentation/ES/5.3.0/RN/KnownIssues Issue : SOLNESS-21783 ... View more

Hi @Harishma, Actually the important field that's added in the search I sent you is marker it will allow you to see which data is from today and which data is from yesterday. So running something like this would allow you to compare both days on a timechart : ... | eval startToday = relative_time(now(),"-24h@h") | eval startYesterday = relative_time(now(),"-48h@h") | eval marker = case(_time >= startToday, "Today", _time >=startYesterday,"Yesterday", 1=1,"Outside Range") | timechart count by marker So the overall search should be like this : | dyntapplications dynt_server=psg-dynatrace-qa.abc.com | search name= | map search="|dyntmetricdata dynt_server=psg-dynatrace-qa.abc.com application=$name$ metric_path=\"Application Infrastructure Performance||Agent|Agent Channels|App Config Poll\" earliest=-1d@d latest=now " |fields sum _time | rename sum as total | eval startToday = relative_time(now(),"-24h@h") | eval startYesterday = relative_time(now(),"-48h@h") | eval marker = case(_time >= startToday, "Today", _time >=startYesterday,"Yesterday", 1=1,"Outside Range") | timechart sum(total) as total by marker ... View more

I guess we're going to have to wait another 7½ million years for the results to display ... ... View more

Ummm.. could you please check what you get if you run index=notable from the search interface ? That will help you make sure that those notables are actually populated and not empty events. If index=notable is working then try this to ensure that events from incident review are there : |incident_review Also play around with the time picker to see if you can see older events on both searches and on the incident review page. ... View more

Awesome, glad I could help ! 🙂 ... View more

ah that's great, please answer your post and accept your answer for future reference ! 🙂 ... View more

@jadengoho, that's great to hear ! Please accept the answer if your problem is solved 🙂 ... View more

hi @thaheseens, Here you go, lots of usecases to see here : ES Dashboards : https://docs.splunk.com/Documentation/ES/6.1.0/User/Overview ES Content Update : https://splunkbase.splunk.com/app/3449/#/details List of usecases here : https://docs.splunk.com/Documentation/ESSOC/1.0.52/stories/UseCase SSE : https://splunkbase.splunk.com/app/3435/#/details List of usecases here : https://docs.splunksecurityessentials.com/content-detail/ Hope this helps ! Cheers, David ... View more

oh, okay so you need both, that would duplicate your logs though since the .log and the .log.gz file are the same no -- just rotated 1 day later ? In any case use crcSalt if thats what you're trying to achieve : [monitor:///data/production/logs/JobBatch/documents] disabled = false index = logs_jobbatch sourcetype = JobBatch whitelist = zipDocument_[\d]+(\.log.gz|\.log)$ crcSalt = <SOURCE> ... View more

Ohhhh okay, gotcha, you can't because the depends panel is hidden. So if you add the table in there it will disappear as well ! The depends Panel will not show on your page so only put configuration that you wish to hide in there 🙂 ... View more

@hrs2019, what do you mean ? You can use a CSS class instead of an ID if you wish to reuse. Is that what you're asking ? And btw the depends="$alwaysHideCSS$" can be renamed to whatever you want, this is just used to hide this html panel, so you can rename the token to anything as long as that token is not set you should be okay. ... View more

Hi @arun_kant_sharma, You're ingesting both rotated files and non-rotated files ? Why not just take the .log files without their rotation ? [monitor:///data/production/logs/JobBatch/documents/*.log] disabled = false index = logs_jobbatch sourcetype = JobBatch Cheers, David ... View more

Hi @hrs2019, Since an ID in css is unique, all you have to do is create a new one for your other table. This allows you to make specific changes for each table when needed : <html> <style> #myFirstTableStyle{ font-size: 50% !important; } #mySecondTableStyle{ font-size: 50% !important; } </style> </html> Your CSS should look something like the above and then you can use one ID for each table. ... View more

Hi @keldridg2, Here are the subquestions I got from you along with their answers, let me know if I missed anything : ....what does the & mean... AND Operation: (& (...K1...) (...K2...)) or with more than two criteria: (& (...K1...) (...K2...) (...K3...) (...K4...)) ...the other is the ! ... Negation: (!(attribute=abc)) , e.g. (!objectClass=group) ...In the search command I see two $ symbols... The two $ symbols are not related to ldapsearch directly they are splunk tokens. The value of the token are set somewhere on your dashboard before being used in your search. You can find almost all the options for the ldapsearch command here : http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm More info about tokens here : https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/tokens Usage examples to create assets and identities: https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.1/User/Theldapsearchcommand#Examples Let me know if this helps. Cheers, David ... View more

Hi @seva98, did this happen after an upgrade or something or has this always been happening ? ... View more