As Rich stated, I don't believe the hot and warm buckets can be separated. If you look at the indexes.conf file, they only give you a homePath, coldPath and thawedPath. Ex [volume:hot_warm_storage] path = /dir/splunk/storage/hot_warm_storage [volume:cold_storage] path = /dir/splunk/storage/cold_storage [test_index] homePath = volume:hot_warm_storage/test_index/db coldPath = volume:cold_storage/test_index/colddb ... View more

A couple of items jump out at me that could cause the discrepancy: 1. Your first query is looking for DocumentName=* and you are counting "Unique Downloads" 2. Your second query is looking for PublicationId=* and it appears it is counting src_ip by Country. Also you are searching on IPLocation=External. The addcoltotals at the end may be adding all of the columns.`enter code here` Without see the results of the data sets, I would recommend keeping the search query as close to identical as possible. Any chance you can post a 'cleaned up' version of the of an event or two from each search? ... View more

You said "one specific connection". Can you run other queries against that 'connection'? ... View more

That's pretty much what I do ... View more

Have you tried setting the MV_Add to its default value? Which is false. ... View more

I agree that the regexes generated that way are overly complex. Although sometimes, at least what I have found, is the ones that are generated will work in Splunk, and the regexes that are you can create and test in other environments don't work. In addition, by generating the overly complex ones, you can put them in something like regex101 and you can start to understand regex and how to work with the data. One question for you. Do you have or know of a good site to learn regex? I have not found any that I would recommend. I have learned by taking generated regexes and breaking them down. So I'm sure I have several regexes that are not written in the best way. ... View more

Are you running this command from the location of the Splunk/bin directory? If you don't have the homepath for splunk configured in your .bash_profile, you would need to run a command similar to this: /"directory where splunk is installed"/bin/splunk enable boot-start If you don't want to type the full path or cd to that directory, you need to set the homepath similar to this in your .bash_profile: export SPLUNK_HOME='the directory where splunk is installed' export PATH ='the directory where the splunk/bin dir is':$PATH I believe this is a rebootable offense, or at least you have to log out and back in for it to take. Hope this helps ... View more

Your indexes.conf should look similar to this for each db: This is a global setting: [volume:'volume_name'] path = 'path to storage' maxVolumeDataSizeMB = 'insert size in MB' <-- I believe this is optional At the index level: ['index_name'] homePath = volume:'volume_name'/db/db Configure that for each volume and index/db and you should be good. Hope this helps ... View more

Have you tried using the Extract New Fields? If you go into "Extract New Fields" select the event that you want, select Regular Expression, then next. Highlight the text that you want extracted, give it a test name. You can then select 'Show Regular Expression', and it will give you a pretty good idea of what Splunk is looking for as far as Regular Expressions go. I have found this method to work most of the time. Using sites like regex101 is useful, although I have put Regex's that I pulled from the above method, not return the same results in regex101. You might have to tweak the regex that you get from the above method, but usually the tweaking is minimal. Hope this helps. ... View more

On all of our systems that have the UF installed, they are running as Local System Account. They do not and should not be run using the Administrator Account. ... View more

Are you running as a specific user, or as the Local System Account? Generally speaking, I believe it should use the Local System Account. Another note, I have always tried starting the service from an Administrator cmd prompt. Not from the Services window. ... View more

I agree with 'jethompson'. As you can see from my earlier post, I have been using this for two years now, and have had zero issues. The only thing I can add, is if splunk doesn't start using systemctl, you need to start it from the bin folder. Most likely there is a config file that is not configured correctly. The only way, that I have found, to discover the misconfiguration is to start splunk from the bin folder. ... View more

Are you still getting the original error of 'The search for datamodel 'Risk' failed to parse, cannot get indexes to search' ? ... View more

No version bug that I am aware of. Let me ask a clarifying question. Are you unable to see the dashboard, or is not finding any results? ... View more

So is your example the raw data? ... View more

To start with your lookup table shows 'Realname,Username' but the data shows Smith, J ( LDN), smithj. So if you ran | inputlookup lookup1 your table is going to look similar to this: Realname username Smith J(LDN) Andy H(LDN) Tan Y(JPN) Same goes for lookup2 Keep in mind a lookup table is a csv file which is 'comma' delimited. Meaning at every "," it sees, it interprets it as a break in the data. You will have to either add a field for the first initial and location or combine them, if you need to maintain the two fields you currently have. The same will apply to lookup2. As far as the search itself, I would try running an eval statement against both lookups. I don't have time to test the eval statements currently. I will try to do that later today, and add to this with the results. ... View more

If the data is all JSON, then you need this in your props.conf: KV_MODE=json http://docs.splunk.com/Documentation/Splunk/7.1.3/Admin/Propsconf ... View more

Are the other tables in the dashboard updating correctly? If so, have you tried creating a single dashboard with the above code to see if it runs correctly? ... View more

Same issue being, task server fails to start or connection failed for user: xxx ? ... View more

Is the jTDS Driver? On the logon issue, does the user that you are replacing 'Local Service' have the appropriate rights to start a service? Meaning is the splunkd service starting? Try running command prompt as Administrator. cd to the Splunk>bin directory, and run splunk restart. Watch the input for any config errors or if the splunkd service fails to start. Make sure you are running the cmd prompt as "Administrator". If you can get everything up and running and are still having the connection issue, here is how mine is configured: jdbc:jtds:sqlserver://host:port/;instance=;useCursors=true;domain=;useNTLMv2=true I believe that SQL by default uses port 1433 as its initial port for logging in. ... View more

Does your Splunk environment have a DMC configured? If so under Search>Scheduler Activity>Instance there are some dashboards that have drill downs that should help you to track down the skipped searches. With it having 'ACCELERATE' you could also look in Settings>Searches, Reports, and Alerts. Use 'Nobody' as the owner, and see if any of them are Accelerated. The DMC route is the best and quickest, as near the bottom of the page there is a 'Count of Skipped Reports By Name and Reason' that should give you the details you need. ... View more

You can create a new role and via default.meta give that role read access. But for any of the dashboards to populate that role will also need multiple capabilities, including search. That role will also need access to specific indexes. Which, by your request, will not accomplish what you want. I'm sure there would be a way of recreating the DMC dashboards in a custom made app, that would remove any navigation capabilities outside of the dashboards you want the user to see. I have a feeling that may be way more effort than its worth to do that. The short version is, I don't know a quick solution or even a moderately easy solution. Keep in mind the DMC accesses a lot of data from many sources. Keep in mind for any search to work the user has to have access to search in addition to the indexes that hold the data. ... View more

I would try copying what I have entered in this post and see if it works. The differences would be the user, group and your splunk home directory. ... View more

Can you provide a copy of your splunk.service file? Are you running splunk as root or as a different user? Is this issue only happening with the two scenarios that you listed? ... View more