Hello Team,  I am running below query to get the stats but I am looking to get the Store numbers in serial order, can you help me with the query ?  index=ABC env="XYZ" StoreNumber="*" | sort by StoreNumber | stats count by StoreNumber, country, Application Store Number country count 1 US 22 100 US 7 100 US 9 100 US 2 1000 US 13 1000 US 10 1002 US 9 1002 US 32 1018 US 22 1018 US 1 104 US 3 104 US 6 1055 US 9 1055 US 28 1081 US 39 1081 US 38 1086 US 1 1086 US 6 1086 US 1 109 US 1 109 US 2 1094 US 3 1094 US 9 11 US 3 ... View more

HI Friends,  I am using below command to check the email alerts but its throwing error and not able to send emails. Can you please help here Command: index=123 info | sendemail to="kumar@xxx.com" subject=AzureTestAlert from="splunk" Error on UI: command="sendemail", [Errno -2] Name or service not known while sending mail to: kumar@xxx.com Error in python.log: 2020-09-03 17:25:24,113 -0700 ERROR     sendemail:143 - Sending email. subject="Splunk Alert: testAlert", results_link="https://splunk-shc-splunk-search-head-0:8000/app/search/@go?sid=scheduler__admin__search__testAlert_at_1599179100_51_CC555C75-B9DE-43D9-93D3-D1C60A6059CF", recipients="[u'kumar@xxx.com']", server="localhost" ... View more

HI Friends, In Search&Reporting app (default app) when I search anything, I see only 3 INTERESTING FIELDS coming up and when I search same thing from other apps (custom apps) on same Search Head I am able to see 100+ FIELDS. I am seeing this issue from only last one week, not sure what caused this issue. How can I get these fields back and fix it, can you please suggest ? ... View more

Hi Team, We are on Splunk 7.1.6 Version, I have configured Splunk Alert to send email and we are getting link to the Alert but the link is not accessible. I see the link has Search Head hostname, when I replace it with Search Head IP I am able to access the link. How can I change the setting so that I get Alert link using IP instead of hostname ? Eg-Hostname: http://sh-46177-3-1732:8000/splunk/splunkdownAlert ----- this is not working When I replace to IP, it works Eg: http://10.10.39.40:8000/splunk/splunkdownAlert ------ This works ... View more

HI Team, I have installed Splunk enterprise Indexers version 7.16 and Splunk UFD version 7.2.5 but I am seeing below errors in the logs and logs are not getting forwarded to Indexers. Can you please help with the fix Errors on UFD: 04-24-2019 18:14:28.351 +0000 ERROR TcpOutputFd - Connection to host=10.10.10.1:9997 failed 04-24-2019 18:14:28.351 +0000 WARN TcpOutputProc - Applying quarantine to ip=10.10.10.1 port=9997 _numberOfFailures=2 04-24-2019 18:15:29.749 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1300 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. 04-24-2019 18:18:49.772 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1500 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data Errors on Indexer: 04-24-2019 18:19:13.854 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59565 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. 04-24-2019 18:19:13.860 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59570 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. ... View more

HI Friends, I have more than 50 Indexes in my Splunk cluster. For a few of the Indexes, the earliest event is showing as 5 Years (checked it by logging in to Indexer UI -> settings -> Indexers) when the frozenTimePeriodInSecs is mentioned as 14days. I am seeing this issue for almost 5 Indexes. Can you please help me how to fix this issue ? [symp] homePath = volume:primary/symp/db coldPath = volume:primary/symp/colddb thawedPath = $SPLUNK_DB/symp/thaweddb # 2 weeks index file retension frozenTimePeriodInSecs=1209600 # creating each bucket of 10gb maxDataSize=auto_high_volume maxHotBuckets = 6 ... View more