The underlying code for both is the same so the performance won't be much different.  The difference is when do you want these fields extracted and when don't you.  KV_MODE=xml will be always done for that sourcetype.  xmlkv will only be done when you use it in a search string.  So if you always want all of the fields to be extracted use KV_MODE but if you only want the fields to be occasionally extracted use xmlkv in your search string. If you only want one or two fields from a big xml file, it might be better to extract them using normal regex extraction Another use for xmlkv is when not all of your event is clean xml. KV_MODE would fail and not give you the fields. In a search, you can use an eval or rex to extract and clean the xml portion and then run xmlkv on that.  ... View more

Thank you! Your solution worked ... View more

yes, depending upon your use case... Check the predict categorical field for starters. You can also use regression to predict server shut down based on the number of exceptions... and many more 🙂 ... View more

Try something like this index=myindex | rename Settings.Student{}.* as *Student Settings.Employee{}.* as *Employee | eval emp=mvzip(nameEmployee,DomainEmployee,"#") | eval std=mvzip(nameStudent,DomainStudent,"#") | table emp std | mvexpand emp | rex field=emp "(?<nameEmployee>.+)#(?<DomainEmployee>.+)" | mvexpand std | rex field=std "(?<nameStudent>.+)#(?<DomainStudent>.+)" | fields - emp std | foreach *Student [eval <<FIELD>>=if(nameStudent=nameEmployee,<<FIELD>>,null())] | stats values(*Student) as *Student by nameEmployee DomainEmployee ... View more

Thanks..! @sundareshr ... View more

The thing that you have highlighted in red is DIRECTLY controlled by the user's Time zone setting (exactly what I described in my answer), which also controls the meaning of the values in the Timepicker (e.g. when exactly is "yesterday"). You NEED to be able to control this user-by-user. If you would like to see GMT for you, then change your setting to GMT . ... View more

yeah I'm guessing tail will result in longer times as Splunk has to read 'through' all of the events to get to the bottom/end of the result set (highly technical description there). A somewhat more inelegant but potentially faster solution might be ... | head 300 | reverse | head 1000 | reverse the point of the numbers though was to get to items number 2k through 3k from your original request. In my environment I did a search on Windows Security Event Viewer logs from a very large index (tens of millions of Windows audit logs). The head / tail solution took 4.9s. The head/reverse/head/reverse method took 2.9s /shrug. ... View more

Hi we are using ad hoc searches only.. May i know where i can find this parameter "adhoc_search_level"?? ... View more

Thanks!! It helped.. search1.on('search:done', function(properties){ var resultscount=properties.content.resultCount; document.getElementById('count').innerHTML=resultscount; }); ... View more

Which App Search Context are you using. For example if you are in the Green Search and Reporting an do a search vs being in the Blue Palo Alto App. Apps have different permissions on fields. So your query might be referencing a fields from Palo Alto that does not have global scope. Also are you in Fast, Smart or Verbose mode? Fast mode means only the | stats fields are brought back. Smart mode means the fields that you have explicitly downloaded apps for apply, when in the right app context. And Verbose means no fields are explicitly setup and Splunk is learning the key values on the fly. Are you running as the same user in both cases? ... View more

Hi Soumya, The best practice would be to install the forwarder on the remote server as well. If that isn't possible, you could possibly leverage syslog (or some equivalent if windows) to forward the events from the one server to the other. For syslog, this blog post has some great config examples : http://www.georgestarcher.com/splunk-success-with-syslog/ Please let me know if this helps! ... View more

After adding user role to all the users the issue got resolved. ... View more

Thank you Martin! Sure, I'll open new questions for any new queries ... View more

I referred the below link and checked on the List of incompatibilities between the old serverclass.conf and what is supported by Forwarder Management.On commenting the unsupported attributes in serverclass.conf the Forwarder management page is showing details. [global] whitelist.0 = * restartSplunkd = true stateOnClient = enabled disabled = true https://answers.splunk.com/answers/185547/forwarder-management-issue.html http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Forwardermanagementcompatibility#List_of_incompatibilities ... View more

Try using [nessus_plugins] BREAK_ONLY_BEFORE = ^# ... View more