fillnull works for me, unfortunately i can mark only 1 answers are "Accept". both your answers were correct.. ... View more

Go to https://ideas.splunk.com to submit a feature request. ... View more

This works good, thank you... Cant see an option to mark this as the answer.. ... View more

Kamlesh, i got the issue fixed by suggestion from gcusello. ... View more

Hi Nick, is the token feature available with 7.2.6 version ? im running this version and cannot find the appropriate role for creating tokens... ... View more

you're welcome. In multiple indexes case, there is easy way that use append . my answer is updated. happy splunking. ... View more

This is not a trivial task. You can go to Settings->Indexes to see which app owns each index, but that doesn't necessarily limit where the index is used. You could search for "index=foo" in all of your dashboards, alerts, and reports, but that would miss those where the index name is specified in a macro or eventtype. Including those still misses searches that use default indexes. ... View more

I don't understand why you want the user to login to different search head to access different indexes. I would suggest not to go for this kind of approach., you add all indexers as peers to single search head and restrict the access to indexes. If there are many users, go for search head clustering. It will be easy to maintain compared to multiple distributed search head. However if you still want to, add some indexers as peers to one search head and others to second search head. In long run as indexes and user increases it will create a mess. Please upvote the answer as well. ... View more

No problem, its always the little things that trip us up! ... View more

Post the SPL. ... View more

What is the plan to provide an updated ODBC Driver...one that will work and be supported? ... View more

you're welcome @jiaqya! ... View more

Join is subject to subsearch and RAM limits. Do not use it. Use ... | stats values(*) AS * BY <joinerfield here> instead. ... View more

great to know it worked. cheers ... View more

awesome 😉 ... View more

Ravi, thanks, think spoke too soon, what if the value to compare is not on the same line . ex: col1=1 and col2=2 on same line, but 2 is found on 2nd line in col1 | makeresults | eval col1=1, col2=2 | append [| makeresults | eval col1=2, col2=1.1] | append [| makeresults | eval col1=3, col2=3] | eval compare = if(col1==col2,"true","false") | eval test = if(compare=="true",col1,col2) ... View more

| loadjob returns the result of the search you ran. you can not filter the results per-se however, lets imagine your search is something like this: ... index=some_index sourcetype=some_sourcetype ... | stats(something) by something_else as something you can add the _time field after your by clause and then have a search / filter after your | loadjob ... where _time > .... complete the rest and have 30 60 and 90 in a drop-down (form input) or something hope it helps ... View more

Another question i have on this. we also have universal forwarder agents installed on servers which send data to the forwarders. Can you direct me to compatibility of the uf agent version wrt to forwarder version of 6.5.2 ... View more

when we create an identity on the sql db connect on the forwarder. i would like to know where all it is being used. Which connections & operations are using it. This is basically needed for me to understand, that if i change the account password for the identity , what all reports will be impacted by this change incase the account gets locked. previous users have created reports using this identity/connection which i have no information about . ... View more

what kind of errors? As you know, when a lot of concurrent searches run, it adds pressure on the IOPS on the storage layer and also consumes disk space for the users. I assume you may have some custom role/storage setting to limit the disk space used by users. This way you can protect the SHs by not running out of disk space and also allow a better user experience by queing mutliple search requests from same users. Yes, increasing storage/IOPS, clustering, limiting user disk quota etc.. will also help. ... View more

Thanks.. this will probably help.. ... View more

Ok thanks, the size of bucket then depends on the bandwidth we have between sites which can be obtained by testing. thanks again Mark ... View more