I opened a case with microsoft for this error - the issue for me was that the docs (both on splunkbase and in the Microsoft docs article referenced by Splunkbase) say that the Message Trace API can gather data up to 30 days prior. This is incorrect. The correct documentation can be found here, which shows that only a max of 10 days prior is allowed: https://docs.microsoft.com/en-us/powershell/module/exchange/get-messagetrace?redirectedfrom=MSDN&vie... ... View more

I opened a case with microsoft for this error - the issue for me was that the docs (both on splunkbase and in the Microsoft docs article referenced by Splunkbase) say that the Message Trace API can gather data up to 30 days prior. This is incorrect. The correct documentation can be found here, which shows that only a max of 10 days prior is allowed: https://docs.microsoft.com/en-us/powershell/module/exchange/get-messagetrace?redirectedfrom=MSDN&view=exchange-ps#description Switching the start_date from 30 days to 9 or 10 days prior ended up working for me! ... View more

I would like to take this moment to say that your best bet is to comment out this entry in the Nix TA until Splunk has a better way to get sourcetypes from linux - cron is a great source of data but it doesn't seem that Splunk cares about making the data actually useful, at least in this instance. If you can create your own sourcetype, you should definitely share it on Github, but other than that, I don't know that we're going to be seeing any tools for this any time soon. There may be a good use case for a supplementary TA that adds onto the linux TA which monitors standard files and assigns/defines the correct sourcetypes for them. ... View more

The cause of this is, when using an SH Cluster, you are suggested initially to use the flag for not overwriting lookups (preserve_lookups) - the issue is that in 5.0.1 the automatic lookups for the Windows TA changed from using sourcetype to using source (since sourcetype is being consolidated in the app). For more information on this change, see this article: https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/UpgradeFromEarlierVersions#Upgrade_saved_searches The solution to remedy this is to either: Update the lookup file manually on the SH members GUI via file upload, which is "windows_apps.csv" Update the lookup file manually on the SH members GUI via search (see this answer from woodcock https://community.splunk.com/t5/All-Apps-and-Add-ons/After-Updating-the-Add-on-for-Windows-receive-error-quot-Could/m-p/454989/highlight/true#M55987) ... View more

Did you remove the Splunk App for Windows Infrastructure, or just the Splunk App for Infrastructure? I didn't have the "Categorystring for windows" Error after removing the Splunk App for Windows Infrastructure, but I did have the app4 issue... ... View more

If anyone is coming across this in 2022, you should know that there's a pretty easy workaround for this nowadays. The issue is with XML parsing, but Splunk allows you to output the results in JSON format with a simple change to your rest query. Instead of my query for lookup transforms: | rest /servicesNS/nobody/app/data/transforms/lookups splunk_server=local You just add the output_mode=json GET argument to it, like so: | rest /servicesNS/nobody/app/data/transforms/lookups output_mode=json splunk_server=local This resolved this issue for me immediately. ... View more

If anyone is coming across this in version 8 of splunk, the expression given by the answer may not work. In this case, use negative lookaheads, which is more reliable: | eval filteredhosts=mvfilter(match(host, "^(?!giraffe).+$")) ... View more

It appears that the best fix for this is to restart the Splunk process on the indexer master - note that restarting via the GUI does not work. ... View more

This really needs to be answered - I get an "invalid JSON" note when running it without the calculationID, but when I have it, Splunk says "error in datamodeledit handler: invalid field name"   ... View more

I am having this issue too - the docs aren't clear about what causes this error, as it's clearly not caused by hitting the event limit, at least not that I can see. ... View more

I used the following to help with this at search time with key-value pairs that had space delimiters and = key delimiters: | extract pairdelim=" " kvdelim="=" This also works when your KV pairs optionally have quotation marks for data that contains whitespace. ... View more

In addition to this, in order to avoid using multiple stats stanzas, I use this type of structure with a stats then an eval: | search (message="Polling" OR message="No data" OR message="503" OR message="Pushing") | timechart count(eval(message="Polling")) as Total_Polls count(eval(message="No data")) as Dataless_Polls count(eval(message="503")) as Error_Polls count(eval(message="Pushing")) as Successful_Polls | eval Percent_Successful=(((Successful_Polls)/Total_Polls)*100) | fields _time Percent_Successful This allows you to just compute one stats function and then evaluate any combination of percentages across your dataset. Of course this is a timechart, so you can just replace this with stats to get the desired functionality. ... View more

Fantastic answer; I made a simpler version without REX, since it is a compute hog, with test examples (if you get an error with the comment macro, just delete those lines): | makeresults `comment("Setting up fields to compare")` | eval mv_more=mvappend("yes", "no", "not", "you"), mv_less=mvappend("maybe", "later") `comment("Begin here")` | eval null_fill = mvrange(mvcount(mv_less),mvcount(mv_more)) | eval null_fill=mvmap(null_fill, "N/A") | eval mv_less_new = mvappend(mv_less,null_fill) By taking the range from the length of the lesser field to the length of the greater field, we're able to eleminate a few eval statements crunching the difference with mvindex. You can try this by adding fields to mv_more; it will give you the same result each time. ... View more

I am having this same problem; not sure what's going on...   ... View more

If you already have your tstats command outputting the format of events you want, you can just tack on this to the tstats command if you don't already have a BY clause:    by _time span=10m | eventstats sparkline(sum(count), 10m) | fields - _time   If you already do have a BY clause, just tack on the _time field and span argument. Then your results will have a sparkline just like as above, except that you don't need to change your tstats to use prestats or any other changes to avoid a double-transforming command. ... View more

Is there a source for not needing bin directories and lookup files in the knowledge bundle? I thought you needed them for search commands and non-automatic lookups? Am I wrong? ... View more

This doesn't work if you have a different index defined under the [monitor] stanzas... so it won't be forced really ... View more

You can also solve this using the sendemail command in a search-type workflow action: | sendemail to=$owner@my.url$ subject="New Notable in: $title$" message="How are you guys doing? This has src $src$ dest $dest$ and severity $urgency$" ... View more

In case anyone else is wondering the answer to this question, there is now a way to do this deployment-wide as of version 4.* Set the following flag globally in $SPLUNK_HOME/etc/system/local/web.conf (under [settings] stanza) and in $SPLUNK_HOME/etc/system/local/server.conf (in [default] stanza): sendStrictTransportSecurityHeader = true ... View more

This doesn't have to be in the search bar, it could even be in the network_tools.conf file... ... View more