Hi @Riegelo1 Yes it did end up solving the issue. Either way, best practice is to use a TA supported by Splunk so they can assist you if it doesn't work. ... View more

@Poojitha were you ever able to get this sorted out? ... View more

I agree with what @KendallW shared its hard to comment anything without checking actual data but this type of ERRORs can mainly happen due to mismatch in timestamps. ... View more

Hi @mayurr98,  Is it ingesting exactly 10,000 events per hour or is that figure rounded?  The query is set to run four times per hour. Does it return 2,500 events per run, or does the first run return 10,000 and the rest 0?  Are there any error messages in the internal logs? index=_internal sourcetype=dbx_* Also, how much more than 10,000 events are we talking here? There could be a few different causes depending on the answers to the above questions. First check there are no other random db_inputs.conf files overwriting your above settings. Perhaps use btool to check this. Next, as DB Connect v3 and above uses HEC under the hood, use btool to check limits.conf to see if the max_content_length setting is too restrictive.  Depending on what you find in the logs, you might also consider reducing the max_rows and/or fetch_size settings and/or decreasing the interval. Counterintuitive as it sounds, this might actually improve number of events returned, if there is some performance bottleneck preventing the query from completing.  Regards, K ... View more

Yes, you can create searches using the REST API in Splunk Cloud. Here are the basic steps: Get a Session Key: Authenticate with Splunk to get a session key. Create a Search Job: Use the /services/search/jobs endpoint to create a search job. You’ll need to send a POST request with your search query in the body. Check Search Status: Use the search ID (sid) returned from the previous step to check the status of your search job. Here’s a simple example using curl: curl -k -u username:password https://<splunk-cloud-url>/services/search/jobs -d search="search index=_internal | head 10" This command will create a search job that retrieves the first 10 events from the _internal index.     ... View more

Hi @isoscow , I am doing this regulary, I create a new event with a correlation search which is added to my episode. In this event there are new fields with the value I want to send to my ticketing system. My Action Rule in my NEAP reacts on this fields. Here is also the conf talk Peter Zumbrink and I did this year at .conf24 where we are telling how we are doing this: https://conf.splunk.com/watch/conf-online.html?search=OBS1137C#/ ... View more

In short, download the codebase from Github as a zip, then you can either install it from the GUI or extract the zip to $SPLUNK_HOME/etc/apps and restart Splunk. ... View more

Hi @irkey , let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

@guillermomolina There is a link at the bottom of every one of their emails - https://discover.splunk.com/subscription.html  ... View more

Hi @nawab123 most likely there is an issue with either your authentication.conf settings, or an issue connecting to the LDAP/SAML system. Check splunkd.log for those kind of errors ... View more

One caveat though - the host field might be being parsed out from the raw message during ingestion. In such case you can't use it for specifying props stanza. ... View more

Hello @yuanliu  Can you please help on my other question? This is more closer to the real data and it has complexity since it's involving multiple fields https://community.splunk.com/t5/Splunk-Search/How-do-I-quot-Left-join-quot-by-appending-CSV-to-an-index-in/m-p/696908#M236826 I think I solved this, but I wonder if there is a way to do it without merging the string and mvexpand I appreciate your help.  Thank you so much ... View more

Yeah i got it, but is it possible to edit the HTML page? My goal is to change the URL so that when we click on the return to splunk, it takes us to customized URL @KendallW  ... View more

I don't know how to extract last sentence, but last line is easy.   | eval lastline = mvindex(split(Message, " "), -1)   Here is a data emulation you can play with and compare with real data   | makeresults | fields - _* | eval Message = mvappend("Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example /local/line499 D://example ......a bunch of sensative information D://example /crab/lin650 D://example ......a bunch of sensative information D://user/local/line500", "Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information Error : someone stepped on the wire", "Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://user/local/line980 ,indo", "Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information Error : Simon said Look") | mvexpand Message ``` the above emulates index=example "House*" ```   Output using this emulation is Message lastline Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example /local/line499 D://example ......a bunch of sensative information D://example /crab/lin650 D://example ......a bunch of sensative information D://user/local/line500 D://user/local/line500 Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information Error : someone stepped on the wire Error : someone stepped on the wire Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://user/local/line980 ,indo D://user/local/line980 ,indo Starting logs( most recent logs) : D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information D://example ......a bunch of sensative information Error : Simon said Look Error : Simon said Look ... View more

Search level extraction : I am thinking instead of json extraction I think it could be easy to add index extraction as json so that each event will treat as json message and the remaining few lines we can do extraction at the search level. let me know your thoughts ? @KendallW  ... View more

Exactly what I needed!  Thanks! ... View more

Hi @sidnakvee , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @KendallW, I tried as you suggested but still it doesn't seem to work. Below is a part of my Dashboard code: "viz_myN1qvY3": {             "type": "splunk.table",             "dataSources": {                 "primary": "ds_Ir18jYj7"             },             "title": "Availability By Market",             "options": {                 "backgroundColor": "transparent",                 "tableFormat": {                     "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",                     "headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",                     "rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)",                     "headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"                 },                 "headerVisibility": "fixed",                 "fontSize": "small",                 "columnFormat": {                     "Availability": {                         "data": "> table | seriesByName(\"Availability\") | formatByType(AvailabilityColumnFormatEditorConfig)",                         "rowColors": "> table | seriesByName('Availability') | pick(AvailabilityRowColorsEditorConfig)",                         "rowBackgroundColors": "> table | seriesByName(\"Availability\") | rangeValue(AvailabilityRowBackgroundColorsEditorConfig)",                         "align": "center"                     }                 }             },             "context": {                 "AvailabilityColumnFormatEditorConfig": {                     "number": {                         "thousandSeparated": false,                         "unitPosition": "after",                         "precision": 2                     }                 } The Availability column still has values aligned to right.   ... View more

Hi @Joshua2 , as also @KendallW said, this isn't the way to work of Splunk: you cannot locally store data n an UF. UF has a local cache that stores data if the Indexers aren't available, but only for a few time and it isn't possible to copy cached logs in an usb drive. You should review your requirements with a Splunk Certified Architect or a Splunk Professional Services specialist to find a solution: e.g. send logs to a local syslog or copy them in text files (using a script) and then store them in the usb drive, but as I said, this solution must be designed by an expert, this isn't a question for the Community. Ciao. Giuseppe ... View more

As per @ITWhisperer 's comment, yes it is case sensitive. Use eval upper or lower to convert them all to the same case ... View more

1) I would like to say thank you for your advice, I think I overlooked the main index.  2) The main reason what I want to split from one source type say test, into index=bank, index=card, index=error is because I need to different access permissions.    ... View more

Hi As other already said, you can do it. BUT 1st you should think is this really needed or not? Or is there better way to do it? How much data you have on this old server? is it better to migrate that data to a new indexer cluster node and then migrate that node into indexer cluster. Also are you really need SHC as you have only two node indexer cluster? Usually SHC creates more complexity than just use one bigger SH. Of course your use case could need it, but then it also needs more bigger indexer cluster and probably that should be multisite cluster instead of standard cluster. I propose that you contact to some local Splunk Partner or PS service and plan your environment based on your real use case and needs. r. Ismo ... View more