@logloganathan an upvote is always welcome ... View more

@samlinsongguo if the answer is correct, please accept and upvote it ... View more

Yes, if you want just to filter for specific indexes and sources, just add them to the return command part. To make sure you are getting what you want, practice with the part of the inputlookup and see the results of something like this: | inputlookup example | eval latest=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , earliest=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S") | eval maintenance="NOT (_time>"+earliest+" AND _time<"+latest+")" | return 10 $maintenance, index | rex mode=sed field=search "s/OR/AND/g" | return $search ... View more

Hey According to their page, in the supported version, 7.0 is not yet available: https://splunkbase.splunk.com/app/1770/ ... View more

Apps themselves don't have "access to data". What regulates access or not are the roles of the user running a search, that may not have access to specific indexes. Can you open of the panels in the dashboard, and extract the search that is underneath it and run it yourself? If you can see the results, than the roles hypothesis gains momentum. Let me know ... View more

Well and to you have events starting in between the others? I mean: event A started at X and ended at Y event B starter at X+5 and ended at Y+3 Do you also have those scenarios? ... View more

Hey Do you have any field that may connect those events? Like an ID? Then you could use transaction command with these parameters endswith Syntax: endswith=<filter-string> Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction. startswith Syntax: startswith=<filter-string> Description: A search or eval filtering expression which if satisfied by an event marks the beginning of a new transaction. https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction ... View more

you're welcome ... View more

Sorry maybe I was no clear enough. The stats I put there was to help you get some more information than just what you had with dedup (which gave you information only from one event per (source,host) pair). I think you have two paths here. Either you want to see the Log_Time, Index_Time for all the events, and you can do the following (which is messy as it shows you all the events: index=* OR index=_ | convert ctime(_indextime) AS "Index Time" | convert ctime(_time) AS "Log Time" | eval lag=_time-_indextime | search lag>1000 OR lag<-1000 | table "Log Time","Index Time",lag,index,host,source What I would do is make some stats on top of that lag, index=* OR index=_ | convert ctime(_indextime) AS "Index Time" | convert ctime(_time) AS "Log Time" | eval lag=_time-_indextime | bucket _time | stats avg(lag) as lag by source,host, "Index Time" | search lag>1000 OR lag<-1000 | table "Index Time",lag,index,host,source I believe this last one gives you the information you actually are looking for. Let me know ... View more

You can have the license installed on the fail over SH but I don't think you can have that one to function as a license master while the active SH is running. So I'd keep the license installed, but I'd keep the passive one as license slave to avoid those errors. If there is some problem with the active one, you'll have to change the passive to active automatically and put it as license master ... View more

If you check Splunk logging inputs, you see that there is no need for that: [monitor:///opt/splunk/var/log/splunk] No need for /* here, why would it differ there? ... View more

What would be the use of that if the user said: "The transfer process deletes the old files and places new, uniquely named files (name based on time of transfer, so no names conflict with old files)." ? Wouldn't the CRCSalt in that case be enough? ... View more

I don't think so, your syntax seems correct. Your CRCSalt should take care of any issues with redundancy checks too... Can you check the internal index for an ingestion of a specific file? At least an entry like 03-15-2018 12:32:55.317 +0000 INFO Metrics - group=per_source_thruput, series="/opt/splunk/var/log/splunk/splunkd.log" Just to see if splunk is actually verifying the file ... View more

Hey Sorry but I checked the values and it should convert to 00:01:18 and 00:07:58, check here https://www.epochconverter.com/ ... View more

Hey This is just a file splunk_sbss? ... View more

Yes, the return give you an ORed list of the values you are returning. But now you need to make a UNION of the maintenance intervals, and that needs to be a logical AND. That is the only thing the rex is doing. Please UPVOTE the comment if it is useful for you! ... View more

You query seems to not be very accurate. dedup host and source will give you one specific value for that, and if you are trying to understand the lag time of a (source,host) pair, you;d do some stats first. index=* OR index=_* | eval lag=_time-_indextime | stats avg(lag) as lag by source,host | search lag>1000 OR lag<-1000 ... View more

Hey TIME_FORMAT=%d/%m/%Y | %H:%M:%S%6N Test and let me know please ... View more

Hello Eventstats maintains the same number of events that you have, and there are actually limits on it: Can you check the reason that is happening is not due to overpassing limits? https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Eventstats In the limits.conf file, the max_mem_usage_mb setting in the [default] stanza is used to limit how much memory the stats and eventstats commands use to keep track of information. If the eventstats command reaches this limit, the command stops adding the requested fields to the search results. You can increase the limit, contingent on the available system memory. Additionally, the maxresultrows setting in the [searchresults] stanza specifies the maximum number of results to return. The default value is 50,000. Increasing this limit can result in more memory usage. ... View more

First, no you don't need to have a Search Head Cluster. Second, you are saying that you have the same license in the peer and a search head. So if that is the case, your problem is between one Search Head (which is apparently you License Master), and each of the peers that may have the same license installed. Why don't you have all the peers as slave licenses from the same license? You only need to have one License installed in one place: the License Master (that can be any Splunk instance that has connectivity to all the others) ... View more

Yes, just use logic on it, negating many periods of maintenance: index="abc" source="xyz" [ | inputlookup example | eval latest=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , earliest=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S") | eval maintenance="NOT (_time>"+earliest+" AND _time<"+latest+")" | return 10 $maintenance | rex mode=sed field=search "s/OR/AND/g" | return $search] Note the 10 after return is just the number of lines of mantenance periods you may have. Feel free to increase that number to whatever you need. Let me know if it works ... View more