Try adding crcSalt= in inputs.conf ... View more

try this: index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count ... View more

try this | metadata type=hosts | eval lastHour=relative_time(now(),"-1h@h") | eval yesterday=relative_time(now(), "-1d@d") | where ( recentTime>yesterday AND recentTime ... View more

try this | metadata type=hosts | eval lastHour=relative_time(now(),"-1h@h") | eval yesterday=relative_time(now(), "-1d@d") | where ( recentTime>yesterday AND recentTime ... View more

I think this is what you are looking for: index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count ... View more

try this |noop |append [ |metadata type=hosts | table *] | append [|metadata type=sourcetypes | table *] | eval t = now() - lastTime | eval name = coalesce(host,sourcetype)| table name t lastTime totalCount type |rename t as "Seconds since Event" | convert ctime(lastTime) timeformat="%m/%d/%Y %H:%M:%S" ... View more

try this index=_internal source=*license_usage.log type="Usage" | stats sum(b) AS volume by h | eval GB=round(volume/1024/1024/1024,5) | table h GB | sort 10 - GB | rename h AS Host ... View more

Try reinstalling your browsers ... View more