As I've learned recently, there's nothing stopping someone from defining a different Host value in an input, and causing that problematic situation much more quickly and broadly.  This seems like a huge oversight in functionality. ... View more

Would you know how to set or unset tokens after clicking the title? ... View more

Here is a base search for Splunk licensing events: index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats values(poolsz) as poolsz sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=(b/1024/1024/1024) | eval pool=(poolsz/1024/1024/1024) | fields _time, indexname, sourcetypename, GB, pool This search will get you a list of usage across index and sourcetype for your specified timerange and is collected into 1 day buckets (since licensing goes by day). In order to get usage by index you can just add "| stats sum(GB) by indexname, _time" to the end of the search and that should give you each index's license usage for each day within your specified timerange. Unfortunately, I am not familiar with Splunk Cloud _internal events. Are these the events that aren't showing index fields within the event? If this search does not work for you, could you post a sample of the events you are seeing? ... View more

To login with a local user: https://mysplunk.myfqdn.com:8000/en-US/account/login?loginType=splunk ... View more

Are you creating these alerts in Splunk core or enterprise security? we had a similar issue with ES. They had to build custom integration on their end(pager duty)... ... View more

If it is a stand alone splunk, navigate to settings -> indexes and and check the apps under App column. there is a good posibilty there are different apps that has different indexes.conf the TA for Windows for example has 3 indexes shipped with it: windows wineventlogs and perfmon Or use this to search the rest endpoint and discover via search bar: | rest /services/data/indexes | table title eai:acl.app hope it helps and you find your indexes ... View more

If you disable the index then 1 of 2 things will happen. Either the data will end up in your lastChanceIndex (most people do not define this) or it will temporarily back up on the forwarder and the forwarder will begin to consume a large amount of RAM and disk space and this will grow for the duration of the outage; this can cause significant problems on the forwarder for the REAL work that is supposed to happen there. When the index comes back online, all the backlogged data will come flooding in to the indexers which can overwhelm the indexers and also cause license violations (think 5 days of data coming to the indexers in just an hour) which will also cause a huge CPU spike on the forwarder. I would not go this route. I would either: Configure a lastChanceIndex and then kill the existing index. https://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf Configure a nullRoute on the Indexer to divert this data from the current destination to a trash can: http://docs.splunk.com/Documentation/Splunk/6.5.3/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues ... View more

Thanks...we'll give that try ... View more

If you click the code button (101 010) before submitting, then the web interface won't swallow your html. ... View more

Thanks skoelpin, That looks like it fixed our issue. Thanks again ... View more

Make sure that all KOs (eventtypes, macros, searches, etc.) are set with app permissions inside of the new app (if any is user/private , it will not be in the app directory). That's pretty much it. If the user does not exist, it will be owned by nobody . No big deal (usually). ... View more

NP. Please accept my answer if it resolves your question. Thanks! ... View more

yes...it's a multi-site cluster with 2 indexers as each site ... View more

(I'm pretty sure) We've done it without giving users admin_all_objects - we just made all the artifacts in the jira alerting app world readable, and we use an account to post into jira that's only allowed to post into jira and nothing else. Our jira projects are independently permissioned. ... View more

Ignore my comment, this was a config issue. The jira admins changed the port we needed to update our configs. ... View more

Running that search in Verbose mode brings back the correct product and count ... View more

If you're going to have multi-site Clustering, why do you need to make it non-Indexer Clustering env? Probably the following steps would work. I strongly recommend to test it in a test env before trying it if possible. Change CM's RF and SF to 1 Restart CM Remove excess buckets to make sure only one copy per bucket Stop CPs(Indexers) and remove Clustering settings Move apps from etc/slave-apps to etc/apps Start the Indexers Stop SH and remove clustering configurations Start SH and add those indexers as Search Peers from Splunkweb Stop CM ... View more

This works well. Thank you 🙂 ... View more

Hi Please try this for your panels none This will hide the progress bar. Nikks 🙂 ... View more

Ohh yes ... thanks for pointing that out. ... View more

Just a little addition to this: you can run use stats and eval to do the same - see this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html the learn more on this topic. cheers, MuS ... View more

I can see if that's the case...I will let you know. Thanks ... View more

frobinson, I got it working. My endpoints were incorrect for the saved searches. Once I fixed those, the whole process came together and worked. I was able to successfully build a script to trigger a second search then another script to disable that search once it sends out the "all clear" message. Thanks for the help ... View more

Thanks for the help cramasta! I tried adding minspan and it still doesn't give us what we were looking for. I think our only option would be to run the script more frequently. Thanks again ... View more