you could use the collect command https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Collect eg: (table the field with the json data, I'll assume it's _raw | table _raw | collect index=<index name> output_format=hec ... View more

Magic.  Thanks Rich. ... View more

Anyone else facing same issues in 8.2.4. Will check with support and see. ... View more

>Or is that the number of seconds in 20 minutes?  yes, 60(s)*20=1200 ... View more

Before you take them offline, change your available sites to site3, site4 so that the CM is operating only on those sites.  Run splunk offline for 24hrs on site1 and site2 before --enforce-counts to make sure everything is running smooth with your new setup.  Your single-site replication factor shouldn't drop below the lowest amount of indexers you have on a particular site so instead of dropping the replication factor to 2, set it as 3 since that is the number of indexers you have in the site. If you set it as two you will get errors.    ... View more

You have an automatic lookup named YYY that is referencing a lookup definition named XXX that either does not exist at all or exists at a privilege level that is lower than that of the automatic lookup definition. Try this search to find the details of the detached automatic lookup : |rest/servicesNS/-/-/data/props/lookups splunk_server=local | search title="YYY" | dedup id | table eai:acl.app eai:acl.owner eai:acl.sharing title overwrite value * | rename eai:acl.* AS * | sort 0 title Use this search to find the details of the detached lookup definition (if it exists): |rest/servicesNS/-/-/data/transforms/lookups splunk_server=local | search title="XXX" | dedup id | table eai:acl.app eai:acl.owner eai:acl.sharing disabled title type filename match_type case_sensitive_match fields_list * | rename eai:acl.* AS * | sort 0 title ... View more

Excellent! ... View more

That's unfortunate but thanks for letting me know. A reinstall really isn't possible at this point. I'll keep digging. I'll update you if I do find a solution though. ... View more

Try this index=myIndex sourcetype=sometype source=somesource | timechart span=1d avg(responseTime) as AvgDailyResponse, count as CallsPerDay | eval dow=if(strftime(_time, "%a")="Sat" OR strftime(_time, "%a")="Sun", "Weekend", "Weekday") | eval weeknum=strftime(_time, "%W") | eventstats avg(eval(if(dow="Weekday", AvgDailyResponse, null()))) as WeeklyAverage by weeknum ... View more

Thanks for this. Bit the bullet and upgraded and things are looking much better 🙂 ... View more

Odd - I don't actually use the SSL forwarding myself, so I couldn't tell you for sure. My guess would be that when you put the parameter in system/local it gets ignored On your indexer run ./bin/splunk cmd btool inputs list If you're using ssl you should have an input stanza like [splunktcp-ssl:9997] . If its [splunktcp://9997] then you're not actually using SSL The server.conf controls the ssl settings for the splunkd port, 8089 ... View more

Worked a treat. Thanks. I can't figure out what gentimes is used for though. ... View more