https://answers.splunk.com/answers/478697/migrating-hotwarm-and-cold-buckets-to-separate-dri.html The above link will be helpful for you to start. Please let me know if you find any difficulties. ... View more

Generally .spec file specifies the syntax, including a list of available attributes and variables. A configuration file may have .spec and .example files under README dir for reference purpose .The .example file contains examples of real-world usage. Splunk Enterprise configuration information is stored in configuration files. These files are identified by the .conf extension and hold the information for different aspects of your configurations. Exceptional in Modular Input ... View more

Try "MS-SQL Server Using jTDS Driver With Windows Authentication" for sql DB. jdbcUrlFormat = jdbc:jtds:sqlserver://<host>:<port>/<database>;useCursors=true;domain=<domain_name>;useNTLMv2=true ... View more

Try this: class infosJSONArrayHandler: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint): if response_type == "json": output = json.loads(raw_response_output) for info in output["infos"]: print_xml_stream(json.dumps(info)) else: print_xml_stream(raw_response_output) NOTE: Python doesn't like inconsitently mixed tabs and spaces for indentation. ... View more

@pruthvikrishnapolavarapu : Thanks for your response.I am not clear on this.Please find the attachment above. Does it mean the Token is in URL and I can exttract using tokens.py?If so can you please help me in the script below and how this script invokes? import datetime def sometoken(): return 'zoo' def sometokenlist(): return ['goo','foo','zoo'] def datetoday(): today = datetime.date.today() return today.strftime('%Y-%m-%d') ... View more

I didn't get you.What you mean by this "The problems is that Splunk puts the overall document into "Body.json". I need to completely get rid of this field, so the data is not put into there" ... View more

So your base search has all required arguments for a servicenow ticket? ... View more

@Imjoin : Your query is not clear.Do you want to know why 2 queries? 1st query is to show the count using time chart command in the panel. 2nd query is to build the input for that dashboard. ... View more

Please post the search query. Example: sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | eval contact_type="email" | eval ci_identifier=host | eval priority="1" | eval category="Software" | eval subcategory="database" | eval short_description="CPU on ". host ." is at ". CPU | snowincidentstream For incidents, the required arguments are category, short_description, and contact_type. For events, the required arguments are node, resource, type, and severity. http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usestreamingcommands ... View more

Check if below works: | makeresults | eval _raw="{\"runDate\":\"2018-05-26T02:42:42 BRT\",\"dataDate\":\"20180524\",\"jobName\":\"autocompleteIndexerCounters\",\"counterList\":[{\"counterName\":\"autocompleteIndexer.output.featureTypeCount\",\"counterValue\":[{\"type\":\"appname\",\"count\":101},{\"type\":\"tld\",\"count\":253},{\"type\":\"keyword\",\"count\":2927}]},{\"counterName\":\"autocompleteIndexer.output.top_5_popular_tlds\",\"counterValue\":[{\"token\":\"windows2universe.org\",\"userCount\":62.981969934674},{\"token\":\"lifehacker.com\",\"userCount\":62.964321782051435},{\"token\":\"cartier.com\",\"userCount\":62.9401599579562},{\"token\":\"ralphlauren.com\",\"userCount\":62.93481540700425},{\"token\":\"rolex.com\",\"userCount\":62.933701958889266}]},{\"counterName\":\"autocompleteIndexer.output.top_5_popular_appnames\",\"counterValue\":[{\"token\":\"Facebook\",\"userCount\":100.0},{\"token\":\"Spotify\",\"userCount\":95.26094213298802},{\"token\":\"com.facebook.orca\",\"userCount\":93.11922468380857},{\"token\":\"com.apple.appstored\",\"userCount\":70.68313382198859},{\"token\":\"Netflix\",\"userCount\":65.30195042706302}]},{\"counterName\":\"autocompleteIndexer.output.top_5_popular_keywords\",\"counterValue\":[{\"token\":\"lamborghini\",\"userCount\":99.94711121453807},{\"token\":\"mercedes\",\"userCount\":99.78833351334077},{\"token\":\"bmw\",\"userCount\":99.69614000941976},{\"token\":\"benz\",\"userCount\":99.41822335991877},{\"token\":\"mercedes benz\",\"userCount\":99.41822335991877}]},{\"counterName\":\"autocompleteIndexer.output.googleTldCount\",\"counterValue\":[{\"token\":\"google.com\",\"userCount\":57.73100429679627}]},{\"counterName\":\"autocompleteIndexer.output.appleTldCount\",\"counterValue\":[{\"token\":\"apple.com\",\"userCount\":57.7610117234952}]},{\"counterName\":\"autocompleteIndexer.output.iphoneKeywordCount\",\"counterValue\":[]},{\"counterName\":\"autocompleteIndexer.output.androidKeywordCount\",\"counterValue\":[]},{\"counterName\":\"autocompleteIndexer.output.facebookAppCount\",\"counterValue\":[{\"token\":\"Facebook\",\"userCount\":100.0}]},{\"counterName\":\"autocompleteIndexer.output.instagramAppCount\",\"counterValue\":[]}],\"projectName\":\"Palomar\",\"releaseVersion\":\"1.4.0.amxbeta\"}"| search _raw="{\"runDate\":\"2018-05-26T02:42:42 BRT\",\"dataDate\":\"20180524\",\"jobName\":\"autocompleteIndexerCounters\",\"counterList\":[{\"counterName\":\"autocompleteIndexer.output.featureTypeCount\",\"counterValue\":[{\"type\":\"appname\",\"count\":101},{\"type\":\"tld\",\"count\":253},{\"type\":\"keyword\",\"count\":2927}]},{\"counterName\":\"autocompleteIndexer.output.top_5_popular_tlds\",\"counterValue\":[{\"token\":\"windows2universe.org\",\"userCount\":62.981969934674},{\"token\":\"lifehacker.com\",\"userCount\":62.964321782051435},{\"token\":\"cartier.com\",\"userCount\":62.9401599579562},{\"token\":\"ralphlauren.com\",\"userCount\":62.93481540700425},{\"token\":\"rolex.com\",\"userCount\":62.933701958889266}]},{\"counterName\":\"autocompleteIndexer.output.top_5_popular_appnames\",\"counterValue\":[{\"token\":\"Facebook\",\"userCount\":100.0},{\"token\":\"Spotify\",\"userCount\":95.26094213298802},{\"token\":\"com.facebook.orca\",\"userCount\":93.11922468380857},{\"token\":\"com.apple.appstored\",\"userCount\":70.68313382198859},{\"token\":\"Netflix\",\"userCount\":65.30195042706302}]},{\"counterName\":\"autocompleteIndexer.output.top_5_popular_keywords\",\"counterValue\":[{\"token\":\"lamborghini\",\"userCount\":99.94711121453807},{\"token\":\"mercedes\",\"userCount\":99.78833351334077},{\"token\":\"bmw\",\"userCount\":99.69614000941976},{\"token\":\"benz\",\"userCount\":99.41822335991877},{\"token\":\"mercedes benz\",\"userCount\":99.41822335991877}]},{\"counterName\":\"autocompleteIndexer.output.googleTldCount\",\"counterValue\":[{\"token\":\"google.com\",\"userCount\":57.73100429679627}]},{\"counterName\":\"autocompleteIndexer.output.appleTldCount\",\"counterValue\":[{\"token\":\"apple.com\",\"userCount\":57.7610117234952}]},{\"counterName\":\"autocompleteIndexer.output.iphoneKeywordCount\",\"counterValue\":[]},{\"counterName\":\"autocompleteIndexer.output.androidKeywordCount\",\"counterValue\":[]},{\"counterName\":\"autocompleteIndexer.output.facebookAppCount\",\"counterValue\":[{\"token\":\"Facebook\",\"userCount\":100.0}]},{\"counterName\":\"autocompleteIndexer.output.instagramAppCount\",\"counterValue\":[]}],\"projectName\":\"Palomar\",\"releaseVersion\":\"1.4.0.amxbeta\"}" |spath output=token path=counterList{}.counterValue{}.token | spath output=Count path=counterList{}.counterValue{}.userCount | eval data=mvzip(token,Count) | table data| mvexpand data | makemv data delim="," | eval token=mvindex(data,0),Count=mvindex(data,1) | fields - data | table token Count ... View more

The question is not clear,but as per my understanding you need to plot a table with enterprisename status and Days,you can use chart command for this: your search |chart status OVER Days BY enterprisename ... View more

Use event order function along with chart command http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Eventorderfunctions ... View more

Can I get the raw data? ... View more

Remove double quotes for newfield calculation and try. ... View more

Found an answer,just have a look on it: https://answers.splunk.com/answers/495132/how-to-preserve-order-of-json-array-in-search-resu.html ... View more

-Try by removing source override @UF inputs.conf. -Make use of HF to do props.conf and transforms.conf and remove it from UF - Make necessary changes to your configuration files. ... View more

Check if below answer helps you: https://answers.splunk.com/answers/664688/splunk-db-connect-3-new-database-connection-to-ms.html#answer-664737 ... View more

Good that it resolved. ... View more

Try some other names. ... View more