I am Getting only a few days back Data, How Can i Get Last 60 Days of ingested Data I am Using Splunk Enterprise... Can anyone Help us!!! ... View more

@raindrop18: excess copies result from peers(indexers) leaving and joining the cluster. you can remove excess buckets from cluster master via cli or web ui. follow the splunk doc for further explanation.. https://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/Removeextrabucketcopies also take a look at data-rebalancing, cluster master removes excess buckets during data-rebalance.. https://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/Rebalancethecluster#How_data_rebalancing_works ... View more

The screen image and the search sentence do not match. Please upload the correct search sentence again. Also please tell me the extraction period. ... View more

thanks for the response. I will check that. ... View more

thanks for the response, but still not filtering DEBUG. is there any difference for the logs ingested via http even collector (HEC)? this issue only I got on the logs ingested via HEC, other logs ingested via UF I don't see this issue. ... View more

yes, if necessary, you can have 2 HFs and you can send them balanced data from your UFs ... View more

hey raindrop18, Please refer the following doc: https://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureAWS Let me know if this helps!!! ... View more

Looking at how the script works, I think you want to run it like this: | base64 action=decode myfield1 myfield2 myfield3 ... myfieldN ... View more

thanks for response. that answer my question!! ... View more

Hi @fabiocaldas, Do you mean your cluster master is also a deployment server? (I note that this is not a supported configuration, even though it works) I hate to be pedantic, but in Splunk terminonology ‘cluster’ has a specific meaning. You can have a team, group, collection or even a pool of heavy forwarders, but you should avoid using the term ‘cluster’ to avoid confusion. I think what your saying is your ‘pool’ of heavy forwarders are deployment clients of your deployment server. The fact that your DS may (or may not be) collocated with your “indexer cluster master” is immaterial, but I would caution others from doing so. ... View more

3365196938 is not a valid epoch time. It seems way in the future. How do you translate it ? ... View more

Hi There, I'm assuming you are referring to Chloropleth maps, on this you should be able to find most the information on these here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/ChoroplethGenerate For yours specifically your going to want to use the iplocation command after your query https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Iplocation ... View more

so this query on regular chart showed me, sorted the client IP has the highest number of username. just added "| sort - dc(UsrName)" at the end. currently on geostats only see the lowest number. ... View more

Like this: The setup: | makeresults | eval rank="msg(1489546552.151:69280424)" The solution: | rex field=rank "msg\((?<epoch>\d+\.\d+)" | fieldformat epoch=strftime(epoch, "%m/%d/%Y %H:%M:%S") ... View more

Hi raindrop18, without access to your system, the only suggest is to verify the usual access problems: hostname, open ports (see internal and external firewalls); enabled web interface. You can verify the first one using CLI at the end of the Splunk boot. For the second one, use telnet from your pc to the Splunk Heavy Forwarder telnet myserver 8000 to verify if there is a firewall problem. For the third one, see in $SPLUNK_HOME/etc/system/local/web.conf if startwebserver is equal to 1 (0 is disabled). Otherwise, I suggest to open a case to Splunk Support. Bye. Giuseppe ... View more

Hi Hi raindrop18, it isn't a problem to manage a lookup: you can create a scheduled search (to run e.g. every night) and put the output in a lookup using the outputlookup command. This is the approach used by DMC: lookup is updated every 15 minutes. Bye. Giuseppe ... View more

perfect,thanks much TStrauch ... View more

This seems to be problem with routing taken to reach the forwarder rather than Splunk or CPU usage. Can you verify entries in routing table? ... View more

This worked for me - you can also add it to the restart command after an upgrade : /opt/splunkforwarder/bin/splunk restart --accept-license --answer-yes --no-prompt ... View more

First of all, NEVER use the "free" date_* fields because they are pre-TZ-normalized values so they sometimes do not exist and when they do, they are always wrong; you must make your own and use those. Secondly, your NOT clause includes ALL DAYS so there is nothing left to use! 😆 Try this: index=mysite host=webserver* "user-loggedin" | eval date_hourmin=strftime(_time, "%H%M") | eval date_wday = strftime(_time, "%w") | search (date_hourmin<=100 OR date_hourmin>=500) | timechart count span=1h ... View more

happy for you, don't forget to accepted and vote my answers ... View more

Hi @raindrop18 I'm glad you were able to find what you needed with @lguinn's answer 🙂 Please don't forget to resolve this post by clicking "Accept" directly below her answer. Thanks! Patrick ... View more

Try something like this | rex "(?i) IP (?P[^ ]+)" | rex "(?i) username (?P<UsrName>[^ ]+)" | eval clientIp=clientIp+"-"+accountNumber | chart dc(UsrName) over clientIp | sort - dc(UsrName) OR | rex "(?i) IP (?P[^ ]+)" | rex "(?i) username (?P<UsrName>[^ ]+)" | stats dc(UsrName) over clientIp, accountNumber | sort - dc(UsrName) ... View more

thank you so much again, perfect outcome and really good lesson. ... View more