I'd just select the proper data, craft a corresponding search after reading all the Splunk docs and then modify it according to my needs. If you find that answer very generic and not very helpful: Your question is the same. 😉 I've no idea what you want/need, what you already have, where you see the challenges, etc etc. Please add a lot more details to your question to allow for a good answer. ... View more

Are searchterms and interestingValue the same for every host, or are they different each time? ... View more

I'm not a Tableau professional, so you might be better off asking in a Tableau community or their support, but I've given it a quick look. As far as I see you can only tell Tableau to load a certain saved search, but it doesn't support to load the results from a scheduled run. You could however try this: Save your search, schedule it, wait until it ran at least once Create a second search, using this query: | loadjob savedsearch="MyUser:MyApp:MySavedSearch" You obviously have to replace MyUser , MyApp and MySavedSearch - this search should simply load the last result from your other search. You can then refer to the second search from Tableau. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Just checking - you want to drop certain events that are supposed to go to a certain index (or some indexes), and also contain a certain string? ... View more

I don't really get what you're trying to do. You're counting the events, and then divide the count by 1024 twice to get an MB value? Are you trying to get the actual size of the events and the average event's size? ... View more

Using | addtotals label=_TOTAL should also be possible, right? Also - if you use sort, remember to use | sort 0 _TOTAL , because by default sort is limited to 10000 results. ... View more

If you want some advanced kind of answer, you should ask some advanced kind of question 😉 So far, your config is fine, besides the mentioned problems/improvements, so I don't know what exactly you're expecting. ... View more

Sorry, that was a misunderstanding, I thought that was a field from your events. What do you mean by transactions? Events? ... View more

Hey, try this: | tstats count where index=* OR index=_* ... View more

Then do a sort on Total, afterwards use | fields to remove it 😉 ... View more

Your regexes are missing the field name that the data should be extracted too, so instead of REGEX ="lat=(?P(.*?))," do REGEX ="lat=(?P<yourfieldnamehere>(.*?))," That should work. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Try this: index=* | eval UserId=mvindex(split(UserId,"@"),0) | eval tcount=eventcount summarize=false | lookup peopledata network_uid AS UserId OUTPUT name as Name, location | chart count by Name, Operation | addtotals Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Ah, damn, I saw that, but forget to post it here. Sorry! ... View more

Always forward all the data to the indexers. Indexers gonna index, Search heads gonna search 😉 Seriously, indexers are built to store the data, you can cluster them, so the data is replicated, etc. Even if they're not clustered - that's where the data belongs. You'll just get yourself in unsupported trouble 😉 Search heads, even clustered, do not replicate their indexed data, because that's not what they're designed for. Therefore - follow best practice, please. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Can you use tcpdump on the Splunk Enterprise instance to check if you get any communication from that instance to TCP port 9997? Also, did you try to check for any logs with my tstats command posted in the other comment? ... View more

I updated my first answer, please check it out. ... View more

Try this: index=something yoursearchhere | stats avg(TPS) AS "Avg TPS" max(TPS) AS "Max TPS" perc90(TPS) AS "90th Percentile TPS" count(TPS) as "Total Sample" by method ... View more

If it's not on Splunkbase, you might be outta luck. You can however contact support or your Splunk account person to request the app to updated. However, only because Splunkbase says it's not compatible with 7.0, doesn't have to mean it actually isn't. It might simply mean it hasn't been tested (and I'm rather sure this is the case here). If I were you, I'd just try it. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

No, not by default. You need to configure your UF with the IP of the deployment server, they don't call home by default. You could do this by doing /opt/splunkforwarder/bin/splunk set deploy-poll YOURSERVER:8089 (and maybe restarting). You could also create a seperate app (this is the clean way!) with a deploymentclient.conf like this: ``` [deployment-client] [target-broker:deploymentServer] targetUri= YOURSERVER:8089 ``` YOURSERVER has to be replaced with the IP or DNS name of your Splunk instance. ... View more

If you don't have anything else in your inputs.conf, you simply didn't setup any inputs. There is no data going to come because you didn't tell it what to collect. 😉 ... View more

On your search head/indexer, see if you get ANY data of that forwarder (you should, if the indexer shows up as "active forwards"). Try it like this: | tstats prestats=t count where (index=* OR index=_*) AND host=yourforwardername by _time index | timechart count by index ... View more