You don't need to convert _time field - index=service | eval Time=_time | eval LastSync=strptime(lastSync, "%Y/%m/%d %H:%M:%S") | eval diff=LastSync-Time | table _time,lastSync,diff,| sort -_time ... View more

You can do a distinct count to see if there are 2 distinct values in 2 days for a field - | eventstats dc(field1) as field1_count,dc(field2) as field2_count by index | WHERE field1 > 1 AND field2 > 1 ... View more

I am sorry I thought you are proceeding with the same set of servers. as @adonio said, Deployer is an essential component of the SHC architecture. I will generate the bundle and push it using one of the SHC members. The replication to all the members will have to done from peer. Here are more on the role of a deployer - http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/PropagateSHCconfigurationchanges More from answers forum - https://answers.splunk.com/answers/268768/deployment-server-vs-deployer.html ... View more

For Search head clustering, you require at least 3 search head instances. If you have a single search head, use the deployment server to move apps to it. http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/SHCarchitecture *Captain election process has deployment implications The need of a majority vote for a successful election has these deployment implications: A cluster should consist of a minimum of three members. A two-member cluster cannot tolerate any node failure. Failure of either member will prevent the cluster from electing a captain and continuing to function. Captain election requires majority (51%) assent of all members, which, in the case of a two-member cluster, means that both nodes must be running. You therefore forfeit the high availability benefits of a search head cluster if you limit it to two members. If you are deploying the cluster across two sites, your primary site must contain a majority of the nodes. If there is a network disruption between the sites, only the site with a majority can elect a new captain. See Important considerations when deploying a search head cluster across multiple sites.* ... View more

Is your DMC connected to all indexers that are receiving data from the forwarders? In our environment we have our custom search to monitor such forwarder issues. | metadata type=hosts | eval diff=now()-lastTime | where diff > 3600 AND diff < 86400 | convert ctime(lastTime) | table host lastTime Check if the results match. ... View more

You can disable the alert "DMC missing forwarders" under "splunk_monitoring_console" app. However, it is a useful search which lists the forwarders which are not reporting to your environment any longer. You can optimize the search to show only those servers which have not responded for more than an hour, in last 24 hours by modifying the search to - | inputlookup dmc_forwarder_assets | search status="missing" | rename hostname as Instance | eval diff=round(now()-last_connected) | where diff>3600 AND diff<86400 | convert ctime(last_connected) This way the list will be small and you can restart the forwarder instances which are down. ... View more

You have to check the forwarder and find the inputs.conf file on the forwarder and modify it. You can get the installation path by checking the directory of the forwarders internal log. ... View more

Check the field EventCode in your lookup and in the raw Splunk events. | lookup filename.csv <lookup-field1> AS <event-field1> OUTPUT "Message Summary" ... View more

Try this - sourcetype=x OR sourcetype=y OR sourcetype=z | timchart span=1h usenull=true count by sourcetype | fillnull value=0 x y z ... View more

You have to ensure that there is at least 1 event from each of the of sourcetype so that you can see 0 values for those. If any of x or y or z has no events at all in the time range you are searching, they won't show up in the results with 0 values for any of the time range. ... View more

Add the usenull flag to the timechart command - sourcetype=x OR sourcetype=y OR sourcetype=z | timchart span=1h usenull=true count by sourcetype ... View more

no problem 🙂 ... View more

date_* default fields are not available for all sources, for instance they are not present for Windows event logs. https://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Usedefaultfields You can try creating the field like below and then filter - | eval date_hour=strftime(_time,"%H") | where date_hour>=6 and date_hour<=12 ... View more

Try moving the convert statement after the comparison. index="xxx" | rename "logs{}.*" as * |fields user.lastName,projectId,user.firstName, user.lastName,time,type,date | eval acteur='user.firstName'." ".'user.lastName' | search acteur="AAA" |rename projectId as NOVA_ID | join[ search index="gtav2_projects" projects{}.icma="*" |rename projects{}.id as NOVA_ID, projects{}.icma as ICMA ] | rename projects{}.title as Title ,projects{}.client.name as "Nom Client" | dedup Title |eval dateLimite =relative_time(now(),"-7mon") | where date > dateLimite | convert timeformat="%d/%m/%Y %H:%M" ctime(dateLimite) |table "Nom Client",Title,ICMA,date, dateLimite, NOVA_ID ... View more

Can you check this part of your query - |eval dateLimite =relative_time(now(),"-7dmon") Looks like the second parameter needs to be fixed. If you want 7 months, it should be "-7mon". ... View more

Yes, the rest endpoint will let you access all configuration - Views - | rest /servicesNS/-/-/data/ui/views/ | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global" ... View more

Can you run the below query and verify if the index is created on your indexers? | eventcount summarize=false index=alerts Verify if all your indexers are listed here. Try restarting the indexers also once. ... View more

It can be installed on a search head cluster as well. Follow the steps given in this documentation - http://docs.splunk.com/Documentation/CIM/4.7.0/User/Install http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall ... View more

Hi Rohith, You could add an ignoreOlderThan setting in inputs.conf. http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf [monitor:///var/logs/system/local/SASMeta_MetadataServer_*.log] index = index_name sourcetype = sourcetype_name crcSalt=<SOURCE> ignoreOlderThan = 2d ... View more

You search should be able to filter the events which triggered the alert. In the alert settings, check on include results(csv, pdf, inline) and save. It should show you the events which triggered the alert. ... View more