Nothing about that search should make an MV field. Try breaking it out like this to see if it helps you debug it better? |eval last_chunk = if((sprints==last_sprint) and ((status=="DONE") or (status=="CLOSED")), points, 0) | stats sum(points) as total sum(last_chunk) as experimental by sprints ... View more

Done thanks ... View more

Very nice writeup and excellent investigations. I think its also worth mentioning (for anyone else that finds this) that if you don't want to use SystemD you can use the old initd method still by using the flag: -systemd-managed 0 to the boot-start command. More info here: https://docs.splunk.com/Documentation/Splunk/latest/Admin/RunSplunkassystemdservice#Additional_options_for_enable_boot-start ... View more

I also tried to do this. I don't believe it is possible with glass tables at the moment sorry. ... View more

As you suspected, its not possible to update the MongoDB. You need to upgrade Splunk. ... View more

I don't thinks its officially supported, but you can follow this process: https://answers.splunk.com/answers/736869/servicenow-how-do-set-extra-custom-fields-when-cre.html ... View more

Hopefully Splunk will add this functionality soon. In the meantime I have created some documentation on how to do this process here: https://answers.splunk.com/answers/736869/servicenow-how-do-set-extra-custom-fields-when-cre.html ... View more

The currently available update set still works fine with Kingston and London even though they aren't explicitly mentioned. Note if you don't have event analytics in your ServiceNow environment you will get importSet errors. These can be safely ignored by "accepting" them. ... View more

You can match carriage return/new line like so: [\r\n]+ also note that \s+ will also match new lines. Since this looks like a CEF format event, I would use a regex like these ones: https://github.com/automine/TA-cef_template/blob/master/default/transforms.conf There is also a CEF app on Splunkbase that might work for you ... View more

Yes it is possible to edit limits.conf and change the max_base_searches. You can change base_max_searches to be higher. There are other settings too. Now typically changing the search limits are a bad idea because they are there to protect you against bad performance. A better solution would be any of the following: - Use a base search on your dashboard. - Use a report acceleration - Use a saved search - and many more options here: https://conf.splunk.com/files/2017/slides/speed-up-your-searches.pdf ... View more

Hmm good to know. Thanks for sharing crodri210 ... View more

OK this is a bit dumb (and something I had forgotten), but btool --dir needs to be specified to the directory beneath "apps" folder and the folder needs to be called apps. Here is a simple way to do it (uses a symbolic link): cd /opt/splunk/etc/ mkdir deployment-apps-for-btool cd deployment-apps-for-btool ln -s /opt/splunk/etc/deployment-apps apps /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps-for-btool/ ... View more

I tried a few things and I was unable to find a solution that works either. As a workaround, you might find that the app Config Explorer https://splunkbase.splunk.com/app/4353/ might make it easier to review the full btool output. Disclaimer: I am the developer. ... View more

"Exploits" like this turn up from time to time. The exploit requires admin credentials to Splunk and it uses the app-upload feature. It is by design that uploading apps can run python and other executables which can do anything. As a Splunk admin you should always be careful about any app you install into your environment, becuase it will gain the ability to run with the same operating system permissions that Splunk is running as. - So never run splunk as "root" user. Here is a good blog post of recommendations for securing your Splunk instance: https://www.splunk.com/blog/2016/07/10/best-practices-in-protecting-splunk-enterprise.html ... View more

Also make sure you aren't in fast mode. ... View more

This looks a bit crazy, but below is one way to do it. Paste it into a new dashboard. I am assuming you have some background knowledge of how to do HTML/CSS. Otherwise this will be very hard. <dashboard> <label>TestDashboard</label> <row depends="$hide_this$"> <panel> <html> <style> #background_table { background:url(https://i.imgur.com/ZodtLh7.jpg); } #background_table th, #background_table td, #background_table .table { background-color: transparent !important; } </style> </html> </panel> </row> <row> <panel> <table id="background_table"> <search> <query>|makeresults count=10 | eval value = random()</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard> ... View more