If the data is already indexed, there is no way to remove it from the index. Splunk has a delete command, but that will only hide the data from searches, it will not free up the space. If you want to keep the current data, you can copy a deduped set of the data to a new index: index=current | dedup identifier | collect index=new This will require additional space, at least temporarily, and a new index to be created. ... View more

Something like: index=sourceA OR index=SourceB | stats min(_time) as start, max(_time) as end, values(action) as action, values(user) by user, values(scr_ip) as src_ip by session You could also use something like a left join, however, join uses the same limits as subsearch and 10K index=SourceB | join type=left session [ index=sourceA | fields user, action ] Would need more specifics ... View more

The easiest way, is to disable the currently configured alert, and re-create it as a scheduled report. Alerts are dependent on trigger conditions to take action (email), reports are not. https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification ... View more

This was added in 6.6: settings -> all configurations -> Reassign knowledge objects ... View more

First, you will need to create the generic or service accounts in Splunk, and ensure they have the appropirate role, capablities, etc.. Next, you just need to migration ownership of the objects. Via GUI: settings -> all configurations -> reassign knowledge objects Select the knowledge objects, and reassign to the service account. VIA Config Files: This gets a little more complicated, since permissions can be applied granularly to specific objects as well as generally to mulitple objects using wildcards. You would need to find the metadata related to the object in question, and modify the owner line: [views/*] access = read : [ * ], write : [ admin ] export = none owner = admin version = 7.1 modtime = 1400528935.011292000 If you using a naming convention for objects, it may be easier to find and group them for this change. ... View more

IIt sounds like map is the command you are looking for: https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Map It sounds like you would like to do something like index=sales | stats sum(sales) as sales by product_id | map search="search index=product_details id=$product_id$" Each product_id returned by the search: index=sales | stats sum(sales) as sales by product_id Will be run through the search index=product_details id=$product_id$ ... View more

It sounds like you want to dedup a multi-value field: | eval a=dedup(a), b=dedup(b) ... View more

What is the search used to generate the table ... View more

When you say "Taking 70%" of the load, do you mean the load on the system is 70% or 70% of the searches are being executed by SH1? Is the high-load related to the Cluster or KVStore captain? Do you see iowait on SH1 or is it only load? ... View more

So, you can use your metrics logs to see the per-source thruput index=_* component=Metrics group=per_source_thruput And match that to your inputs/serverClass? ... View more

Your file does not include a customerid column. Did you mean productId? sale_price>30 | field productid Of do you need to find the customerid in a seperate set of data, for any customers that bought a product that was over 30? customerid=* [ search sale_price>30 | field productid ] ... View more

We create a app for each serverClass, using a standard naming convention we created: Acme_CHI_hfw_inputs/local/inputs.conf All inputs are maintained in this server class. We do the same for indexes, and well as baseline settings: Acme_CHI_idx_indexes/local/indexes.conf Acme_ALL_idx_base/local/limits.conf, distsearch.conf, etc.. By using a standardized naming convention, we know what settings are applied to which servers. By seperating these settings from the original Add-On, we have one location to update. We also use the ConfigQuest app to report on settings deployed, and serverClass members. Mileage may vary. ... View more

According to what's you've written, tour base search IPresolver, ends with | fields user This means, fields like queried_domain are getting dropped, so they are not available to the table command. I would adjust the IPResolver line to | fields _time, user, queried_domain ... View more

So, the UF is sending data that hasn't really be parsed as much as metadata about source, soucetype, etc.. is sent with it. For example, the UF does not perform line breaking for events. It sends file content in chunks to the indexer. The indexer is fully parsing the data, which includes line-breaking and index time extractions, this basically defines how individual events are identified and indexed. It takes the chunks of data, and the information about that data (the metadata sent with it from the forwarder) and runs the data through the parsing queue. The search head does report time parsing, which is really just cosmetic, in that it can change how the event is displayed but does not change how the event was indexed. So, to answer your question: Now when the logs are moving from Indexer to Search Head, will they still be adapting the same setting, what it was on forwarder, or it will take the setting of default? No, the indexer will not use the settings from the forwarder. If a props.conf for this host, source, or sourcetype is not configured, then Splunk will use the default settings and attempt to learn this sourcetype. The metadata sent by the forwarder is available (source, sourcetype, index) and will be used unless over-rode by props.conf defined on the indexer. ... View more

No. outputs.conf deals with how the data is sent to other instances (i.e. UF to indexers). The options you listed are not valid for that configuration file: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf ... View more

Are you expecting me to make changes in the props.conf of Indexer, till now what changes i am making was all in Universal Forwarder I think the timestamp and hostname are extracted on the UF, so it would probably work if only on the UF. But Im not positive which is why I recommended putting it on the indexer as well. ... View more

the only way to do this on the search head via SPL, would be to make the timestamp you want to use available in the event. For example if the files were created with the timestamp in the name: logfile-03_04_2005_01_02_30.log then you could do something like: | rex field=source ".*-(?<mon>\d+)_(?<day>\d+)_(?<year>\d+)_(?<hour>\d+)_(?<min>\d+)_(?<sec>\d+).log" | eval event_time=mon. "/" .day. "/" .year. ":" .hour. ":" .min. "sec" | eval _time=strptime(event_time, "%m/%d/%Y:%H:%M:%S") | timechart count ... View more

The only way to force splunk to do something, is to configure it that way. You will need to create a props.conf that defines how to extract the timestamps from the events. If you have a multi-server implementation, I recommend creating an app which is just a folder structure: C:\Program Files\Splunk\etc\apps\MyApp\ In that app, create your props.conf: C:\Program Files\Splunk\etc\apps\MyApp\local\props.conf In that props.conf you will then need to define how you want Splunk to extract the timestamp: [your_sourcetype] TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S%z MAX_TIMESTAMP_LOOKAHEAD = 21 SHOULD_LINEMERGE = false I recommend pushing that app to the forwarder monitoring the file, and your indexers. ... View more

Why don't you just search your proxy logs based on the values in the blacklist: index=proxies sourcetype=bluecoat [ search index=proxies sourcetype=blacklist | fields bl_host | dedup bl_host | rename bl_host as cs_host ] This will results in a list of cs_hosts from the proxy logs, that were in the blacklist logs. ... View more