Can you check _internal logs for particular S3 input? Is there any timestamp related warning or error? ... View more

Hi, For Windows: Are software installed on windows machine are listed in windows registry? Windows script will only report installed software recorded in the Windows registry; other software (like putty) will not be reported. Refer this link: https://answers.splunk.com/answers/126533/using-splunk-to-determine-installed-software.html Also you can take help of following link to create modular input using powershell script: https://answers.splunk.com/answers/444328/how-to-list-out-unwanted-software-installed-on-use.html ... View more

Hi, Is it single server deployment OR distributed environment? ... View more

Hi, This link may helpful for you : https://answers.splunk.com/answers/562805/how-to-force-to-set-certain-fields-host-and-source.html ... View more

Install TA's on forwarder and apps on splunk instance ... View more

For linux based forwarder you can use Unix's app : https://splunkbase.splunk.com/app/273/ For Windows you can use below links: https://splunkbase.splunk.com/app/742/ ... View more

Yes you have to modify it according to your environment. Try this one: | rest splunk_server=local /servicesNS/nobody/splunk_app_db_connect/db_connect/connections ... View more

Hi vincenp2, You can try using rest command : | rest splunk_server=local /servicesNS/nobody/splunk_app_db_connect/configs/conf-db_connections/ ... View more

Did you check that tcp 8089 port is open between CM and indexers? ... View more

Please refer below steps from documents: **Add a custom logo** If you are using Splunk Enterprise, you can customize the login page logo. **Prerequisites** The maximum image size is 485px wide and 100px high. If the image exceeds these limits, the image is automatically resized. Review the loginCustomLogo setting details in the web.conf spec file. **Steps** (Optional) If you are using an image file, put it into the following directory location. $SPLUNK_HOME/etc/apps/<app_name>/appserver/static/logo ... View more

Did both event have same _time? Can you provide sample event after indexing? ... View more

Could you try converting timestamp field in sql query? ... View more

What user you use while installing splunk? ... View more

Hi, Did you search index=_internal logs for that client? ... View more

Hi nawazns5038, Could you please provide sample events? Also in TIME_PREFIX try changing rex to \"time\"\:\" ... View more

Did you restart splunk service? ... View more

Hi, Did you try changing following setting in limits.conf: [kv] limit = 300 Refer following doc: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Extractfieldsfromfileswithstructureddata#Structured_data_files_with_large_numbers_of_columns_might_not_display_all_extracted_fields_in_Splunk_Search ... View more

Hi, Try this: | eval finishtime_new = case(isnull(finishtime), currenttime) | eval finishtime_epoch = (finishtime_new, "format_of_finishtime_new") | eval starttime_epoch = (starttime, "format_of_startime") | eval diff = finishtime_epoch - starttime_epoch ... View more

You can make new field : | eval finishtime_new = case(isnull(finishtime), currenttime) ... View more

Hi 56838396, Do you mean dynamic threshold for every x-axis values? ... View more

Hi chitreshakumar, you can convert starttime and finishtime in epoch using strptime function using eval: | eval finishtime_epoch = (finishtime, "") | eval starttime_epoch = (starttime, "") | eval diff = finishtime_epoch - starttime_epoch ... View more

Hi, This document may help you : http://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Sitereplicationfactor ... View more

Then you can use field extractor to extract values , Or use rex command "| rex field=(replace field name where it is being captured) "hinf=(?P[^|]+)|cert=(?P[^|]+)|ipsec=(?P[^|]+)"" ... View more