I usually use a combination of the .conf VSCode linter that others have suggested for writing, and then upon committing I have AppInspect and the Splunk Packaging Tool run for my apps, and this keeps them bug free and knowing that I will pass cloud verification. I will also drop these since I wrote them and am biased, but I use them myself for writing SPL in VSCode: Splunk Search Syntax Highlighter Extension  and Splunk Search Autocompletion Tool  ... View more

It is absolute insanity that we continue to have this issue - Regex isn't that hard, but Splunk makes it harder by creating new rules and exceptions to those rules. Unfortunately this is why Splunk is in the position they are in - not user-friendly, and lack of proper GUI features that allow testing before integration. ... View more

This worked for me on my updated version - thanks! ... View more

I think you should open a support ticket for this. ... View more

How do you restore from this method? If I clean the KVstore after backing up like this, won't untarring over the cleaned files just put the system back in the state it was, uncleaned? Or even worse, would it break mongo? ... View more

Unfortunately the --verbose flag doesn't provide the serverVersion key/value pair either in 8.2.1 ... View more

This extension has a community one that is based on the tmLanguage spec: https://github.com/arcsector/vscode-splunk-search-syntax/blob/master/syntaxes/splunk_search.JSON-tmLanguage The catch is you'd have to convert it into the SyntaxHighlighter spec here, which atlassian uses: https://github.com/syntaxhighlighter/syntaxhighlighter/wiki  Hope this helps. ... View more

It doesn't appear that the "serverVersion" value is available with this command even with the verbose tag in splunk versions 8.X ... View more

I opened a case with microsoft for this error - the issue for me was that the docs (both on splunkbase and in the Microsoft docs article referenced by Splunkbase) say that the Message Trace API can gather data up to 30 days prior. This is incorrect. The correct documentation can be found here, which shows that only a max of 10 days prior is allowed: https://docs.microsoft.com/en-us/powershell/module/exchange/get-messagetrace?redirectedfrom=MSDN&vie... ... View more

I opened a case with microsoft for this error - the issue for me was that the docs (both on splunkbase and in the Microsoft docs article referenced by Splunkbase) say that the Message Trace API can gather data up to 30 days prior. This is incorrect. The correct documentation can be found here, which shows that only a max of 10 days prior is allowed: https://docs.microsoft.com/en-us/powershell/module/exchange/get-messagetrace?redirectedfrom=MSDN&view=exchange-ps#description Switching the start_date from 30 days to 9 or 10 days prior ended up working for me! ... View more

I would like to take this moment to say that your best bet is to comment out this entry in the Nix TA until Splunk has a better way to get sourcetypes from linux - cron is a great source of data but it doesn't seem that Splunk cares about making the data actually useful, at least in this instance. If you can create your own sourcetype, you should definitely share it on Github, but other than that, I don't know that we're going to be seeing any tools for this any time soon. There may be a good use case for a supplementary TA that adds onto the linux TA which monitors standard files and assigns/defines the correct sourcetypes for them. ... View more

The cause of this is, when using an SH Cluster, you are suggested initially to use the flag for not overwriting lookups (preserve_lookups) - the issue is that in 5.0.1 the automatic lookups for the Windows TA changed from using sourcetype to using source (since sourcetype is being consolidated in the app). For more information on this change, see this article: https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/UpgradeFromEarlierVersions#Upgrade_saved_searches The solution to remedy this is to either: Update the lookup file manually on the SH members GUI via file upload, which is "windows_apps.csv" Update the lookup file manually on the SH members GUI via search (see this answer from woodcock https://community.splunk.com/t5/All-Apps-and-Add-ons/After-Updating-the-Add-on-for-Windows-receive-error-quot-Could/m-p/454989/highlight/true#M55987) ... View more

Did you remove the Splunk App for Windows Infrastructure, or just the Splunk App for Infrastructure? I didn't have the "Categorystring for windows" Error after removing the Splunk App for Windows Infrastructure, but I did have the app4 issue... ... View more

If anyone is coming across this in 2022, you should know that there's a pretty easy workaround for this nowadays. The issue is with XML parsing, but Splunk allows you to output the results in JSON format with a simple change to your rest query. Instead of my query for lookup transforms: | rest /servicesNS/nobody/app/data/transforms/lookups splunk_server=local You just add the output_mode=json GET argument to it, like so: | rest /servicesNS/nobody/app/data/transforms/lookups output_mode=json splunk_server=local This resolved this issue for me immediately. ... View more

If anyone is coming across this in version 8 of splunk, the expression given by the answer may not work. In this case, use negative lookaheads, which is more reliable: | eval filteredhosts=mvfilter(match(host, "^(?!giraffe).+$")) ... View more

It appears that the best fix for this is to restart the Splunk process on the indexer master - note that restarting via the GUI does not work. ... View more

This really needs to be answered - I get an "invalid JSON" note when running it without the calculationID, but when I have it, Splunk says "error in datamodeledit handler: invalid field name"   ... View more

I am having this issue too - the docs aren't clear about what causes this error, as it's clearly not caused by hitting the event limit, at least not that I can see. ... View more

I used the following to help with this at search time with key-value pairs that had space delimiters and = key delimiters: | extract pairdelim=" " kvdelim="=" This also works when your KV pairs optionally have quotation marks for data that contains whitespace. ... View more

In addition to this, in order to avoid using multiple stats stanzas, I use this type of structure with a stats then an eval: | search (message="Polling" OR message="No data" OR message="503" OR message="Pushing") | timechart count(eval(message="Polling")) as Total_Polls count(eval(message="No data")) as Dataless_Polls count(eval(message="503")) as Error_Polls count(eval(message="Pushing")) as Successful_Polls | eval Percent_Successful=(((Successful_Polls)/Total_Polls)*100) | fields _time Percent_Successful This allows you to just compute one stats function and then evaluate any combination of percentages across your dataset. Of course this is a timechart, so you can just replace this with stats to get the desired functionality. ... View more

Fantastic answer; I made a simpler version without REX, since it is a compute hog, with test examples (if you get an error with the comment macro, just delete those lines): | makeresults `comment("Setting up fields to compare")` | eval mv_more=mvappend("yes", "no", "not", "you"), mv_less=mvappend("maybe", "later") `comment("Begin here")` | eval null_fill = mvrange(mvcount(mv_less),mvcount(mv_more)) | eval null_fill=mvmap(null_fill, "N/A") | eval mv_less_new = mvappend(mv_less,null_fill) By taking the range from the length of the lesser field to the length of the greater field, we're able to eleminate a few eval statements crunching the difference with mvindex. You can try this by adding fields to mv_more; it will give you the same result each time. ... View more

I am having this same problem; not sure what's going on...   ... View more

If you already have your tstats command outputting the format of events you want, you can just tack on this to the tstats command if you don't already have a BY clause:    by _time span=10m | eventstats sparkline(sum(count), 10m) | fields - _time   If you already do have a BY clause, just tack on the _time field and span argument. Then your results will have a sparkline just like as above, except that you don't need to change your tstats to use prestats or any other changes to avoid a double-transforming command. ... View more