Following on hasham19833 answer (https://answers.splunk.com/comments/754583/view.html) This search (index=tst_aaa AND id_a=*) OR (index=tst_bbb AND id_b = *) | eval id = if(isnull(id_a), id_b, id_a) | stats values(id_a) as id_a values(id_b) as id_b by id | eval m = if(isnull(id_a) OR isnull(id_b), "not matched", "matched") will produce id id_a id_b m 1111 1111 1111 matched 2222 2222 not matched 2424 2424 not matched 3333 3333 3333 matched 3344 3344 not matched 4444 4444 4444 matched ... View more

AWS Fargate PV1.3 now supports the Splunk log driver https://aws.amazon.com/about-aws/whats-new/2019/05/aws-fargate-pv1-3-now-supports-the-splunk-log-driver/ ... View more

These are the ports that Ive had to change (Search Head in my case) Can be done in conf files etc/system/local/web.conf [settings] httpport = 18443 mgmtHostPort = 18089 appServerPorts = 18065 etc/system/local/server.conf [kvstore] port = 18191 Or you can do it form the CLI splunk set web-port set the port that Splunk Web listens on splunk set splunkd-port new port that splunkd should listen on splunk set kvstore-port sets the port that the KV Store uses splunk set appserver-ports new port that Splunk application server should listen on ... View more

HI, You can use query parameter in the the GET request for example: when you will be running curl -X GET https://SPLUNK_SH:8089/servicesNS/nobody/SH_APP/storage/collections/data/KVSTORE_COLL?query={%20%22$and%22:%20[{%22def_id%22:{%22$gt%22:1049}},{%22def_id%22:{%22$lt%22:1060}},{%22sla_status%22:%220%22}]} it is an URL encoded { "$and": [{"def_id":{"$gt":1049}},{"def_id":{"$lt":1060}},{"sla_status":"0"}]} query, and you will get all the items that their def_id is 1050-1060 AND sla_status = 0. Once you have the _key of all the items you want update, just submit the new full content of the items, since it's actually overwrite, and there is no update as such, you will need to re-submit all the "data" fields with their values For more information please refer (to the official documentation) here https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTkvstore#Queries or (my understanding) here http://isbyr.com/splunk-kv-store-using-rest-api/ Regards, ILYA ... View more

Hi, Have you tried to send DELETE call to https://{{sh_url}}:8089/servicesNS/nobody/{{sh_app_name}}/data/transforms/lookups/{{lookup_name}} you might need to change nobody to specific user if the lookup is defined having user and not app level permission. for example using curl curl -X DELETE \ https://{{sh_url}}:8089/servicesNS/nobody/{{sh_app_name}}/data/transforms/lookups/{{lookup_name}} Regards, ILYA ... View more

Thank you very much Luke ... View more

Thanks for confirming and submitting an issue ... View more

That's our set-up [http] enableSSL = 1 sslPassword = $1$IA1A1A1A1 privKeyPath = /opt/splunk/etc/auth/splunkweb/hec.mydomain.com.key serverCert = /opt/splunk/etc/auth/splunkweb/hec.mydomain.com.pem ... View more

HI @mayurr98 Yep,I saw the official docs however didn't see whether there are any length restriction, wanted to hear from community experience whether anyone faced any issues with long names (60+ chars) before I decide on the standard naming convention for my environment ... View more