So you have two Universal Forwarders, one in your Lab DC and one on the PRODUCTION. And you have two Splunk Enterprise, one Lab and one PRODUCTION. Is this correct? ... View more

Hi You jus need one set of \" in the beginning and one in the end, like this | eval myval="\""+myval+"\"" ... View more

Well I understand what you want to do but I really don't see what are you avoiding by this. User will still be able to search past events by using the "Between". So if that was your goal, it won't work by suppressing the "Since". If you think the users are searching too much data in their searches, the best solution is to actually teach them to narrow down their search window, because searching smaller and precise intervals gives best performance and makes sense not to get all the data in if they don't need it. Here "education/training" is the key. Those time picker options are tools, you just need to make sure they use the tools in for the correct purpose and the proper manner. ... View more

Hi Yes the timepicker influences everything on that search, so that is not the inconsistency. I also don't think that it happens only with relative time ranges. I just tried it with a fixed period and I get the same 1 event discrepancy. I'm curious about this and tried it myself, and found differences too, but I think due to the summariesonly. Using the summariesonly=t in such a precise comparison may be misleading, as the most recent events may not be accelerated yet. Having that said, the dm results having 1 more event doesn't really make any sense to me either. Investigating ... View more

Hmm it should not be zero. Maybe it is zero because the percentage is too small and I rounded it to 2 decimal cases only. But I did not understand if you just want the percentage of failed logins the percentage splitted for all the values of action.objectType? ... View more

Hi Can you check if that works for you? index=search | eval Applications = "$App_token$" | rex field=Applications "^(?<Application>^\D+)" | rex field=Applications "^(?<Install_Version>^\d.*)" | dedup Mac_Address Application | search "StoreNo"=* Mac_Address=* "Install Status"=* "App Updated Date"=* "Last Seen"=* "OS Version"="*" |chart limit=50 count over "Application" by "Install Status" | eval Application=if(Application=="*","All","*") It is just a cosmetic operation in the end of the whole calculations ... View more

If you want what the login failure percentage was in 10min increments index=okta host="domain.com" earliest=-1d latest=now() | timechart span=10m sum(eval(if(action.objectType=="core.user_auth.login_failed",1,0))) as failure_logins, count as total | eval percentage=round(100*failure_logins/total,2) Let me know if it solves your issue ... View more

Hi If you check just the output of this part: index=okta host="domain.com" | top action.objectType You'll see there is no _time field anymore, so timechart could not function without his base _time field. ... View more

Please try this one (^\\\\domain\.org\\teams\\)(?<Team>[^\\]+) ... View more

Yes you can install a different HF. Use the same .tgz file you used for your other installation, but now "untar" that into a new directory. No separate download needed. A HF is a full Splunk instance so you just need to use the Splunk Enterprise .tgz. Configure it the same way as the first one. You will have a different web port, splunkd-port, etc but Splunk takes care of using different ones. You don't need to use a different separate license, you can reference the license you have (somewhere in a Splunk instance of you environment functioning as a License Master) ... View more

Hi Yes you can use a Splunk Universal Forwarder with Splunk Free. The host of where you are placing the UF, it has to be you to find that out as it is your environment. After getting that hostname, go to your Splunk Enterprise,->Settings->Data Inputs-> TCP and open a port to receive data from your Universal Forwarder. Then go to your Universal Forwarder and set up an outputs.conf in an app you want, like this outputs.conf under $SPLUNK_HOME/etc/apps/app_you_want [tcpout] defaultGroup = primary_indexers [tcpout:primary_indexers] server = <your Splunk Enterprise Host Name>:<the port you just opened in the Splunk Enterprise>, ... View more

Notice that you're syntax in the rex is not correct, this is how it should be: | rex field=sample "transactionid\"\:\"(?<transactionid>[^\"]*)" | rex field=sample "eventType\:\s\:(?<eventType>[^\"]*)" and I copied the exact same event you posted and got your desired results. Please recheck with this index=cloudfoundry sourcetype=cloudfoundry_apps "cf_foundation=px-npe01" "cf_org_name=EQM-SCMS" "cf_space_name=Test-SCMS-qlab02" "cf_app_name=tfb_hardGoods_SCMS-test" transactionid | rex field=_raw "transactionid\"\:\"(?<transactionid>[^\"]*)" | rex field=_raw "eventType\:\s\:(?<eventType>[^\"]*)" | table eventType,transactionid ... View more

I see what you want. Can you clarify me your final goal here? If you just remove the "before", and still allow the users to set a Data and Time range, then they would still be able to search old data. I'm missing the point ... View more

Hi I believe this is answered here: https://answers.splunk.com/answers/222650/limit-choices-in-default-timepicker.html ... View more

Hi A modular input is a script that you can ask splunk to run and grab the results. You can make a simple test with a shell script like this: Configure scripted data input in $SPLUNK_HOME/etc//default/inputs.conf. Use the local directory for the app to overwrite behavior defined in the default directory. Here is an example: [script://$SPLUNK_HOME/etc/apps//bin/starter_script.sh] Make sure your script has execute permissions there for the Splunk user. ... View more