Linux indexers and forwarders are capable of receiving logs forwarded by Windows machines already, so I can't imagine a scenario where that wouldn't be sufficient for you. If you have a Windows container already, you should be able to install the Splunk Universal Forwarder inside it without issue. Splunk makes life easy when it comes to installing their product, as there are no external dependencies; they package all the libraries and executables needed in the installer you download from Splunk. ... View more

What do you mean "App-Exchange license"? ... View more

In outputs.conf you can configure multiple indexers to forward to, which will somewhat accomplish load balancing. From the outputs.conf doc: [tcpout:indexers] server = 10.1.1.197:9997, 10.1.1.200:9997 This should result in your data being split among multiple indexers, even though it was one input file. ... View more

The previous answer wanted you to have two searches, one for your panel, one that is separate from any panel and really just sets the tokens. For your panel search, something like this: <query>host="xxx-xxx-xxx" sourcetype="alarm_metric" | spath "Message.SourceApp" | search "Message.SourceApp"=xxxx | eval spath='Message.EventMessage' | rex field=spath "took (?P<elapsed>\S+)" | eval elapsed = elapsed/1000 | table _time spath, host elapsed | eval ReportKey="This Time 7 Days Ago" | append [search host="xxx-xxx-xxx" sourcetype="alarm_metric" | spath "Message.SourceApp" | search "Message.SourceApp"=xxxx | eval spath='Message.EventMessage' | rex field=spath "took (?P<elapsed>\S+)" | eval elapsed = elapsed/1000 | table _time spath, host elapsed | eval ReportKey="Today"] | chart count by elapsed span=1 ReportKey</query> <earliest>$earliest7$</earliest> <latest>$latest7$</latest> Note I moved $earliest7$ and $latest7$ out of the search string and into the earliest/latest fields below. But if you do need to use a token in a search string, you need to make sure it's surrounded by $ (on both sides). Your pasted XML had some instances of $ on only one side of the token name. And then another search higher up in the dashboard to set the tokens: <search id="set_time"> <query><![CDATA[| makeresults | addinfo | eval earliest7=info_min_time-7*24*3600, latest7=if(info_max_time="+Infinity", now()-7*24*3600, info_max_time-7*24*3600)]]></query> <done> <condition match="'job.resultCount' == 1"> <set token="earliest7">$result.earliest7$</set> <set token="latest7">$result.latest7$</set> </condition> </done> </search> Consider referencing this recent answer I posted regarding how this may look as a complete XML example. ... View more

Yes, as stated in a previous answer, you really need these logs to be ingested as pan:log first. You're going to run into complications if you try to rewrite the sourcetype with a transform (as the PA TA does this as well). ... View more

The license report may give you the answer you're looking for. /en-US/manager/search/licenseusage Check the 30 day tab, it shows stack size, which would change if/when you removed/added a license. ... View more

Artifact of previous attempt. 🙂 WIll fix in answer. ... View more

Updated answer to reflect the percentage. ... View more

Paste the output of: ./bin/splunk btool transforms list route_boeing --debug ./bin/splunk btool props list mectest --debug ... View more

This is almost certainly an instance where there's a better way to accomplish what you're looking for without using join . And looking at your search, the first join search only returns the machine value, which is what is being joined on, so I'm not convinced this accomplishes anything. Can you include sample events for each of the searches and indicate what you want the final result to look for? ... View more

Refer to the Splunk documentation for specifics, but the general idea is you would create an app in deployment-apps on the deployment server, say, windows_forwarder_phonehome , that contains deploymentclient.conf . Then you create a server class that defines which hosts you want to configure (in this case probably a filter for all windows hosts), and add this app to the serverclass. Further explanation without specific questions is getting a bit too close to "teach me to use a deployment server", but hopefully the above gives you an idea of what you're looking for. ... View more

Can you explain why you want to use streamstats here? I'm not clear what it is you're trying to accomplish with that specific command. ... View more

You may try clearing the messages to see if they return. I've seen instances where the messages will not clear on their own. ... View more

And when configuring via the UI, it has to be in the form <fieldname>::<value> , you can't use just <value> . ... View more

Excellent description. You might consider adding it to the question so that others have an easy time determine what the solution means, and why it was needed. ... View more

That's a good question. If this is a standalone instance, running oneshot on the same splunk instance that props/transforms are defined should be sufficient. But if this server is a universal forwarder props/transforms need to be on the indexer (or heavy forwarder) it is forwarding to. ... View more

Here's XML for potentially a partial solution, which allows you to set the earliest time of a search based on a specific time format in an input: <form> <label>608999</label> <search id="format_start_time"> <query><![CDATA[| makeresults | eval start_time_string="$start_time_tok$" | eval start_time_epoch=strptime(start_time_string, "%x %I:%M:%S.%3Q %p") | fields start_time_epoch]]></query> <done> <condition match="'job.resultCount' == 1"> <set token="start_time_epoch">$result.start_time_epoch$</set> </condition> </done> </search> <fieldset submitButton="true" autoRun="false"> <input type="text" token="start_time_tok"> <label>Time</label> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal | stats count</query> <earliest>$start_time_epoch$</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> ... View more

Did you restart splunk after making those changes? ... View more

This command will show you where it is defined: ./bin/splunk btool indexes list volume:summit_ps --debug ... View more