Hi, I have one Splunk Enterprise license which I am using on one Cloud hosted environment. Now recently I setup another separate Splunk enterprise server on on-premise environment and there is no connection with on-premise and cloud environment. Then I tried to use same license (which I am using on cloud environment) on on-premise environment and I am able to use that license on on-premise environment as well. And I haven't received any error as well. Am I doing correct or violating any rules? If violating then can you please point to any reference where it is written so that I can take further action(if required). Note- I am aware that I can create one license master and other as slave but I am not allowed to make connection with cloud env. and on-premise env. Thanks, ... View more

I have one csv lokup which looks like- Group numbers A 1 A 2 A 3 A 4 B 5 B 6 B 7 B 8 From above I am populating dropdown to show distinct Group ..In this case dropdown will show "A" and "B".And next to that I am using multiselect input -which will run from index query to populate numbers multiselect. and as per selection of group it should pre-populate numbers from csv lookup . For example If I select Group from dropdown as "A" then multiselect should populate numbers "1","2","3","4" and allow user to select any other numbers from spl query- index="abc" |stats count by numbers will it be possible in splunk.Please help. Thanks, ... View more

I have one Heavy forwarder where zip files are ingested and parsed and hardware specification of HF is 64 GB Ram and 4-core, windows OS. I have set parallel ingestion pipeline to two. and my CPU utilization is around 60-65% and 2 cores are fully utilized while remaining two cores utilization is very less. so how could I tell splunk to utilize remaining two cores. is there any setting? also indexing of data is very slow at indexer and after continuous indexing also 15GB data is getting indexed for whole day due to which backlog is increasing. Please help me how can I utilize all 4 cores on HF? Note- I have one Heavy forwarder and one indexer+search Head ... View more

Hi I am getting logs one/two days older in splunk and I want to create table which will show how long CPU was high above threshold value (which is user configurable from input). for ex. lets consider I want to show sources whose cpu was high 40 and in same table want to know how long time duration it was high? Is it possible in splunk. Please advice. logs look like 2019-11-12 01:01:04.120, per_cpu=40 2019-11-12 01:03:04.120, per_cpu=41 Thanks. ... View more

I have events like below 2019-10-21 04:17:54.968, rev=true 2019-10-21 04:17:55.968, rev=true 2019-10-21 04:17:56.968, rev=false 2019-10-21 04:17:57.968, rev=false 2019-10-21 04:17:58.968, rev=true 2019-10-21 04:17:59.968, rev=true 2019-10-21 04:18:00.968, rev=true Here I want to calculate duration starts from rev=true till rev=false and then sum these duration. from above events I would like to calculate duration from 2019-10-21 04:17:54.968 till 2019-10-21 04:17:56.968 and again from 2019-10-21 04:17:58.968 till 2019-10-21 04:18:00.968 . I tried transaction command but unable to succeed . kindly help. ... View more

I have indexed file using INDEXED_EXTRACTION=csv in props.conf when I search index=abc field_name=123 I get results in all three modes i.e. fast/smart/verbose mode and all fields are getting extracted as expected but when I try index=abc field_name=123|table field_name I only get results in Verbose mode and fast/smart mode gives no results. Then I tried using fields in search still same issue. index=abc field_name=123|fields *|table field_name This will also give results in Verbose mode and fast/smart mode gives no results. Kindly help on this to resolve issue . Thanks, ... View more