@danillopavan Can you please paste more events ... View more

There is an app splunk 6.x dashboard examples in splunk base. https://splunkbase.splunk.com/app/1603/ It has examples for drilldwon behavior in visualization ... View more

Hopefully this document helps https://wiki.splunk.com/Community:HandlingEventsTimeStampedInTheFuture ... View more

Are all the servers are in same timezone ? ... View more

Please share your search query ... View more

If you are still receiving though you have deleted the alert , the alert is triggering from another instance . Please check the email ID of the alert that's been sent and contact the admin team to look into this ... View more

Usually the search jobs will expire automatically after 10 minutes, If they are running lots of searches you need increase srchDiskQuota the maximum disk space in MB to store the results of the searches, increase this one if you are planning to retrieve a lot of results , in authorize.conf ... View more

Can you share your search and output .... It helps to understand the scenario in better way Thanks ... View more

may be There are invisible escape characters in the code . remove the spaces between the lines and create a new dashboard with new name ... View more

Here are my thoughts and pleast test on your test instances before proceeding Change the mgmthost port on the DS from 8089 to available port by making the changes in system/local/web.conf Before that deploy the new app with new target uri port to the UF's and wait till all of them are restarted . --> Once UF's are restarted , make the splunkd port change on the DS and restart it . With this connectivity is established ffrom UF's to DS , because as splunk precedence looks at the app/local you would be fine . ... View more

See this answer https://answers.splunk.com/answers/581635/can-i-use-relative-time-for-bin-span.html ... View more

There is an app splunk 6.x examples which provides basic concepts and also sample searches to populate dashboards fast and easily. Hopefully it helps https://splunkbase.splunk.com/app/1603/ ... View more

You can watch this .conf session for understanding regex use in splunk http://conf.splunk.com/sessions/2017-sessions.html#search=Michael%20Simko& ... View more

Generally in windows logs for every event there will be one EventCode per event . unable to understand the criteria "For triggerring the alert both event codes have to be activated?" Per my understanding , does the alert needs to trigger if both the event codes occur with time difference ? ... View more

Replace [Test_Data.txt] with [Test_Data] , Restart the server. It should work. Please let us know ... View more

SPLUNK FOR PCI compliance has that feature http://docs.splunk.com/Documentation/PCI/3.4.1/User/Reports ... View more

Please follow this -->Make sure you have no transforms configured for that data for routing purpose Forward all data This example shows how to send all the data from a forwarder to a third-party system. Since you are sending all the data, you only need to edit outputs.conf: [tcpout] [tcpout:fastlane] server = 10.1.1.35:6996 sendCookedData = false ... View more

Try running broken hosts app https://splunkbase.splunk.com/app/3247/#/details ... View more

Is it the user wants to know which access he has on the dashboard panel ? If yes , try this | rest /services/authentication/current-context splunk_server=local | table title roles username | rename roles as title | mvexpand title ... View more

Place |search Cmdset!=transfer* at the end of the search ... View more

--> To eliminate transfer upload from stats result Instead of where replace it with search CmdSet!="" AND Cmdset!=transfer* For the list You need to bump the size in limits.conf ... View more

sourcetypes are specified in props.conf file It resides on indexers and it applies the config to incoming data from forwarders to indexers ... View more

Try something like this |spath input=_raw | stats values(*) as by error(which is unique identifier) ... View more