probably those 2 indexers receiving more data from a particular host most of the time that has parsing or aggregation issues. If all the indexers and configurations are identical, then ideally it should have been same. Do all indexers have similar specifications? ... View more

@danielbb You can go to Monitoring Console -> Indexing -> Input -> Data Quality and look for any parsing or aggregation issues (line breaks , timestamps etc.) and if they are more in number you can try fixing that source type, it should help reducing your parsing and aggregation queues. ... View more

@rajiv_r Try the solution provided here- https://answers.splunk.com/answers/338917/search-head-cluster-captain-election-fails-with-er.html ... View more

@dmenon Try the below index=firewall | append[| inputlookup serverip.csv |rename IP as src_ip]| stats values(dest_IP),values(url),values(dest_location) by src_ip ... View more

@d942725 Welcome :). Can you please accept the answer. ... View more

@hketer - Probably it has configurations for modular inputs from other app or add-on which is not part of config bundle. See this document for indexer cluster- https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall ... View more

Is this feature still under consideration? Hope to have it soon. ... View more

@icodebro - You can check in your Activity->Job , search your job name and in Actions , click on Job, Inspect job and you can see the count of results and search log. Also you can click on the job and see the results for last 2 hrs. ... View more

@siddharth1479 Try this index="uam" User="abcd" | eval access_time=strftime(_time, "%Y-%d-%m %H:%M:%S") | rename access_time as TIME|fields "USER" "TIME"| dedup USER TIME ... View more

@pratapa Do you have monitoring console enabled. You can just got on your monitoring console -> Indexing->License Usage today and License Usage last 30 days. ... View more

You can try like below example- | makeresults | eval str="(hgd(j,h(((sjs)ii))hhf))" | rex field=str ".*\(.*\(.*\((?<test>.*).*" |eval flag=if(ISNOTNULL(test),"true","false") ... View more

What is meant by HEC response time here? The time HEC event is released from source and reaches Splunk HEC instance or Splunk indexer. The time between HEC instance(HF) to indexer would be very very small rather instant, so I would consider response time as time when event was indexed and time when event was released from the actual source. ... View more

@vrmandadi you should not use deployment server for performing Splunk upgrade. For the Heavy forwarders it will be just like any other Splunk Enterprise instance upgrade. For Universal forwarders on Windows and Linux you can use deployment tool for Windows like SCCM or script for Linux. This document will be helpful for you for upgrading UF remotely. Do check for pre-requisites and whether you really need an upgrade for UFs. https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/UpgradetheWindowsuniversalforwarder https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/Upgradethenixuniversalforwarder ... View more

@louispaul76 where are you using the token , can you write the query or tag where the token is being used. ... View more

@lufermalgo :- you can look for _indextime of your logs coming from HTTP event collector and compare with the timestamp in logs. The difference will be the response time between logs sent from source and indexed at Splunk. ... View more

@eliasit - Did you check under Seetings->lookup->automatic lookup. Is the lookup present there , probably the permissions are not correct, that is why you are seeing the error. ... View more

@jrfreeze When you click on the DAshboard EDIT , you see 2 buttons at Edit Dashboard-> UI and Source. From Source you can edit the code of your dashboard. ... View more

@danielbb Sorry I didn't know there was a parent thread. Yes that's correct a notable event or Indicator of Compromise should be produced in order to populate notable index. You can create a test correlation search and test it with any event , just to check . Any event in . notable index would update the Security Posture Dashboard and Incident Review dashboard. ... View more

@sjcoluccio67 You can keep your query as it is , and in the alert configuration -> Edit Alert -> Trigger Conditions->Trigger Alert when Number of Results >1 ... View more

@paola92 Any update to this, even I am getting the same error message. ... View more

@reverse Please see the answers by richgalloway and mayur, that should work for you. ... View more