Hey everybody, I am trying to set up a mix of multisite and single-site indexer cluster in an splunk enterprise environment. I want our Searchhead Cluster to search through the multisite and single-site IDXC. But after rolling out the SH configuration I get the following error. The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but it is missing the 'multisite' attribute' for master=xxx My server.conf for the SH looks like this: [general] site=site0 [clustering] mode = searchhead master_uri = clustermaster:singlesite1,clustermaster:multisite1 [clustermaster:singlesite1] multisite=false master_uri=xxxx pass4SymmKey=xxxx [clustermaster:multisite1] multisite=true master_uri=xxxx pass4SymmKey=xxxx site=site1 After distributing this config the strange thing is, that the Multisite Configuration doesn't appear in the Webinterface on any SH. If I add the multisite CM manually the error from above is popping up, and I cant search my data. Second strange behaviour is that, when adding the SearchPeers themselve, without a CM, the data is searchable without any problem. Looks like the config isnt pulled. Otherwise every conneciton works fine: IDXC-Singlesite -> CM Singlesite, IDXC-Multisite -> CM Multisite, and every instance is connected to a central Monitoring Console. I read about a similiar problem in a question already asked, but the offered solution didnt help. Thanks for any help, Max ... View more

Hey, i have different devices that are sending temperature data to my Splunk instance. For alarming, I want to compare the temperature data of the last two measurements that were sent. Ideally, I want to do this for all devices at once. So, my goal is to create a table like this: deviceid last_temp second_last_temp difference xxxxx 25 20 5 xxxxx2 35 18 17 Based on the calculation of the difference, I want to configure my alarming... The events look like this: { "deviceId": "4D3F7A", "time": 1542800341, "data": "9e46544000808f41", "duplicate": false, "categoryId":"5bb366f22c9fbb00da468aee", "temperature" : "17.9375" } I probably just have "a knot in my brain" right now and can't get to a solution. Thanks in advance. Max ... View more

Hey everybody, I got a search in which I'll try to visualize who many calls from an IP a calling a specific URL. The stats part of my search is kind of easy at the moment and looks like this: | rename client_host as SourceIP | stats values(domain) as Domains count by SourceIP It gets me a table like this: SourceIP Domains counts 127.0.0.1 www.google.com 12 www.reddit.com 127.0.0.2 www.google.com 6 The count in the last column only gives me the total amount of calls on all domain the IP called. How do i get a unique value for each domain the IP Adresse called? I tried it on another way, but only could make this work where a single IP had only a single Domain and this was kind of ugly... 😉 Thanks in advance! Max ... View more

Hello, I want to fill my KVStore with information from a script. The script adds data via a REST Endpoint to the KVStore. The key in the store is a hostname of a machine. The problem is, if I want to add a new host to the KVStore, but there is already an entry for this host, I will get an error. On the other hand, I can't use the "Update-method" because if it is a new host, I will get the an error as well. I know that I could handle this problem in my script, but I wanted to know if there is a "clever" update function: If there is a record in the KVStore then update the item, and if there isn't, create a new one. thank you in advance. ... View more

Hello, In one of my dashboards, I am using a filter field to search for one UserID. Can I edit my search or my filterfield, so it is possible to search for more than one userid as an input? e.g. like "userid1|userid2|userid3" as an input would resolve in something like "userid=userid1 OR userid=userid2 OR ..." thanks in advance. hype ... View more