Check if you have internal data from those cloud forwarders in your indexers. If you don't, then you have to search that in the place that data is being sent. More check your hosts name syntax if it matches he filter I put in the first line ... View more

If you want to filter for a particular group of servers just put it in the beginning of the search index=_internal host=cld* source=*license_usage.log type=Usage earliest=@d | eval MB = b/1024/1024 | rename st AS sourcetype | timechart span=1d sum(MB) AS "Total MB used" by host Don't forget to upvote useful comments ... View more

Splunk data goes only once through the parsing pipeline so there is no way to do exactly what you are asking for ... View more

Yes all justified and clear now ... View more

In order to make a Server a Deployment Server, you just need to put one app in the $SPLUNK_HOME/etc/deployment-apps folder. Then you go to the Splunk UI, Settings-> Forwarder Management and you can start creating your serverclasses. That;s all. A standalone instance is a searchhead of itself, and you don't need to configure anything for it to search hits own data. If you have a set of instances that are functioning as Indexers only, then you can configure your search head (s) to distributed their searches to the Indexer Layer. More details on that here: https://docs.splunk.com/Documentation/Splunk/7.0.2/DistSearch/Whatisdistributedsearch ... View more

You have to configure all your non Indexer instances (including your License Master) to forward data to the Indexer Layer. Then in a Search Head that searches your indexers, you can do this index=_internal source=*license_usage.log type=Usage earliest=@d | eval MB = b/1024/1024 | rename st AS sourcetype | timechart span=1d sum(MB) AS "Total MB used" by host ... View more

Please upvote and accept answers ... View more

My bad, forgot to put it as Code | rex field=_raw "ConnectorException\:s(?<ConnectorException>.*)" ... View more

Working solely on the example you gave in the question, | rex field=_raw "ConnectorException:s(?.*)" ... View more

You are forwarding your internal data of Splunk Forwaders to your Indexer layer. If you check your internal index for license_usage.log and get a stats sum of license by host, you'll get that info for all the forwarders. To get only the cloud ones, I suggest you filter that by their name ... View more

Ok so if the webserver is not loading, something may have gone wrong on start up. Can you check splunkd.log for errors related to the webserver? ... View more

This behaviour is not related to that Lookup. It is actually related to how your events are arriving to Splunk and how they are tagged in the sourcetypes. For instance if you have WinEventLog:Security, SYSTEM account is considered by the Splunk_TA_for_Windows as a default account ant therefore tagged as tag=default, and so it shows up in that correlation search. You should try to understand why are your events tagged with tag=default in one of the sourcetypes you are getting wrongful data. ... View more

What about the host field in the logs? ... View more

You can copy my example to a test instance you may have and see for yourself that Panel 2 is stuck between Panel 1 and Panel 3 Let me know if it worked for you ... View more

Can you go check your Deployment Server in your instance UI and check that serverclass is actually not including any of those clients? Have those configurations been done on the serverclass.conf? If so, are you sure that the Deployment Server has been restarted after it? Feed me back please ... View more

Do you have Splunk started? If you get to http://localhost:8000 and get the front page of Splunk Logins? ... View more

Hey The reason is that you are reaching your search quota, as the message says. You may have scheduled searches and many users filling up your resources and making you reach that limit. Each role has specific search quotas for historical and real-time searches. So each user that belongs to a role has its own set of limits for disk usage, historical searches, real time searches, and others you can find here http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/authorizeconf#authorize.conf.example If your limits.conf hasn't been changed, it means by default you have max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches Which would be 1x4+6=10 The same number of real-time searches. You can check all those parameters in http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Limitsconf You may need to disable some scheduled searches to get this controlled actually. Check your scheduled saved searches and start disabling them. ... View more

As you can see here, https://splunkbase.splunk.com/app/1810/ this app is not supported for versions over 6.1 ... View more

Hey The MultiSite Clusters have *site replication factor and site search factors *. With that in mind, you can always control how many copies you will have of the data generated in each site with the origin parameter. Furthermore, you can specify how many copies each site has: site_replication_factor = origin:2, site1:1, site2:1, site3:1, site4:3, site5:1,site6:1 total:9 Imagine your site1 has a new bucket b1, than site1 will have 2 copies of b1, and site2,3,5,6 will have 1 copy and site4 will have 3 copies. This gives a total of 9 copies of a single bucket. In this particular example, the replication factor explicitly specifies all sites, but that is not a requirement. A non-explicit site is a site that the replication factor does not explicitly specify, and so it may not have bucket copies for all buckets in it, which would be a good scenario for a smaller data center. So no, you can control that and your smaller site doesn't need to have everything of the larger site. For full detailed info on this: https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Multisitearchitecture ... View more

Can you check the _audit index for the search to give us more insight? ... View more

Nice one! ... View more

If the answer/comments contributed to you, please don't forget to support by upvoting and accepting answer ... View more