Hello,   is it possible that splunk changed the way how it calculates the search time? I have searches with "152,98 startup.handoff" and "This search has completed and ... in 2.272 seconds. " so without putting the huge handoff time in there. Looks like benchmark cheating 😉   Regards Arnim     ... View more

I have this issue also and believe the issue is caused by the Stream app on Splunk Cloud. If I create a group within the app on my hybrid Search Head which I am using to configure streams it won't match a forwarder even though it has been discovered. On Splunk Cloud, If I duplicate the group created on the Hybrid SH it will then match the forwarder on the Hybrid Sh. I have been informed that configuring streams on Cloud is not allowed but I am struggling to find an alternative solution. On Splunk Cloud the Stream TA is needed for the indexing layer but I am wondering whether removing the app from Cloud will it fix this issue. Has anyone had any progress with this issue ... View more

Thank you, for number precision it is working fine, but the value is displayed black. I want to get colored values accordingly e.g: 0%-40% green, 40%-80% blue etc . Is it possible? Can you help me with it. ... View more

It is fixed in the next version of Enterprise, not what is currently available. ... View more

@gustavomichels Just a little heads up regarding your initial question. I just found this out myself, but if you turn on XML logging for wineventlog all of the values that come in the "message" field gets extracted. You can check it out here: http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/ ... View more

My suggestion is to clean a bit the xml document, to be something like - <Exception timestamp="05/05/2014 14:25:53" ...> <StackTrace> <Frame exceptionType=...> <Context> <Request_ApplicationPath>the_path</Request_ApplicationPath> <Request_Url_AbsoluteUri>the_url</Request_Url_AbsoluteUri> <ApplicationName>the_appname</ApplicationName> </Context> </Frame> </StackTrace> By using the xml sourcetype, you can reach the xml elements via - | spath StackTrace.Frame.Context.Request_ApplicationPath . ... View more