I am attempting to run a query that will find the status fo 3 services and list which ones are failed and which ones are running.  I only want to display the host that failed and the statuses of those services.   The end goal is to create an alert.   The following query produces no results index="server" host="*"  source="Unix:Service"   | eval IPTABLES = if(UNIT=iptables.service AND (ACTIVE="failed" OR ACTIVE="inactive"), "failed", "OK")  | eval AUDITD = if(UNIT=auditd.service AND (ACTIVE="failed" OR ACTIVE="inactive"), "failed", "OK")  | eval CHRONYD = if(UNIT=chronyd.service AND (ACTIVE="failed" OR ACTIVE="inactive"), "failed", "OK") | dedup host  | table host IPTABLES AUDITD CHRONYD This query works index="server" host="*"  source="Unix:Service"  UNIT=iptables.service  | eval IPTABLES = if(ACTIVE="failed" OR ACTIVE="inactive", "failed", "OK")  | dedup host  | table host IPTABLES How can I get the query to produce the following results host         IPTABLES       AUDITD    CHRONYD server1       failed                OK                OK ... View more

I have a query that detects missing systems.  the lookup table has fields System, Location, responsible. I am trying to get the location and responsible to show in the end result.  It appears the join is losing those values.   Is there a way to get those values to the final result? | inputlookup system_info.csv | eval System_Name=System | table System_Name | join type=left Sensor_Name [| search index=servers sourcetype=logs     | stats latest(_time) as Time by System_Name     | eval mytime=strftime(Time,"%Y-%m-%dT%H:%M:%S")     | sort Time asc | eval now_time = now()     | eval last_seen_ago_in_seconds = now_time - Time     | sort -last_seen_ago_in_seconds ] | stats values(*) as * by System_Name | eval MISSING = if(isnull(last_seen_ago_in_seconds) OR last_seen_ago_in_seconds>7200,"MISSING","GOOD") | where MISSING=="MISSING" | table System_Name Location Responsible MISSING ... View more

I have several apps setup to segregate our various products. I’ve added icons to the apps. My issue is the icon is being placed over the app name. It should place the icon next to the app name. For example, the Search and Reporting app has the White arrow on a green background to the left of the app name. How do I get the icon to be placed left of the app name? ... View more

I have a splunk distributed system with 3 indexers, 3 search heads, a manger, and 2 heavy forwarders.  I am attempting to deploy the DB Connect application to the HF and the SHC.  The SHC has 3 member nodes and the deployer on the manger node.  Ideally, this would all be done with ansible, sadly, the deployer gets in the way.  I can deploy to the HF with ansible, but the deployer keeps removing the db connect app on the SHC. That said, to deploy I install the app on the manager node, install the drivers, and then copy it to the ...shcluster/apps directory  and run the splunk schcluster apply command.   I've done this both manually and using ansible.   When I run the apply the deployer does not put the entire app on the search heads, it only puts the default and metadata directories on the Search heads in the splunk_app_db_connect directory.    When I go into the manage  apps on the GUI I see the app installed but it is not visible.  I would prefer not to use the GUI for management and perform all management task via the cli and ansible.  The code is stored in a version control system and gives not only control over the deployments but also trakcs who did what, when, why, and how.   So I guess there are multiple questions.   Why is the deployer not pushing the entire application to the search heads? How can I disable the deployer and just use ansible? ... View more

Operating System: Oracle Linux 3.8.13-55.1.5, 64 bit 2 CPUs, total of 40 cores, 128 gb memory, 1 GB network, 6 300 GB, 15K SAS drives The only thing running on this system is Splunk Enterprise. Indexing Performance is 250KB/S approximately 20GB per day. According to the Capacity Planning Documents, this system should easily handle 250 GB per day. The files are JSON files. Memory Usage and CPU usage are WAY LOW. What could be slowing down the indexing? ... View more