Hello Splunkers! 🎉 You can now easily install Splunk Enterprise and the Universal Forwarder using this handy script. It supports all available versions and can be installed on any Linux distribution. For detailed installation steps, please visit : https://github.com/PraxisForge/Install_Splunk Upgrade universal forwarder version (nix) #Splunk Enterprise(nix) #Universal Forwarder(nix) #Upgrade Splunk Enterprise version(nix) ... View more

You need a transforming command (such as stats, timechart, or top) to return search results in a data structure that supports both tables and chart visualizations. Remove the table from the end and change your search like this eventtype=egress_* File_Type=*| stats sum(Detail_File_Size) as Data_converted by File_Type | eval Data_converted=case( Data_converted>=(1024*1024*1024*1024),round(Data_converted/(1024*1024*1024*1024),0)."TB", Data_converted>=(1024*1024*1024),round(Data_converted/(1024*1024*1024),0)."GB", Data_converted>=(1024*1024),round(Data_converted/(1024*1024),0)."MB", Data_converted>=1024,round(Data_converted/1024,0)."KB", 1=1,Data_converted."B") ... View more