This answer https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-token-in-a-multi-select-form-input/m-p/480570 is close to what you want.  You would end up with a set of sourcetype=data1 OR sourcetype=data2 etc. And you can initialize the default value with comma separated values as shown in https://community.splunk.com/t5/Dashboards-Visualizations/choose-all-Multiselect-values-by-default-without-using/m-p/357860 ... View more

Sounds like you might want to use two bin commands. First bin by time: | bin _time span=1h   Then bin the netPerf.netOriginLatency into 5 (?) bins e.g. | bin netPerf.netOriginLatency bins=5 See the bin command https://docs.splunk.com/Documentation/Splunk/9.2.2/SearchReference/Bin Finally you could do a timechart with your bins (you will have to do your percentage etc calculation) ... View more

What I tend to do to get all the results in email or Slack is to use stats as described here https://community.splunk.com/t5/Reporting/Using-result-fieldname-in-email-text-body-splunk-email-alert/m-p/399711   ... View more

Splunk has finally added the issue to their known issues page https://docs.splunk.com/Documentation/Splunk/9.2.0/ReleaseNotes/KnownIssues  https://docs.splunk.com/Documentation/Splunk/9.2.1/ReleaseNotes/KnownIssues ... View more

If you always want to ignore the same hosts each time, you could create a lookup file with names of the hosts and use a search as described in this post: https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-IP-s-not-in-a-lookup-table/m-p/371170 Something like index=myindex NOT [|inputlookup mylookup.csv | fields host]   ... View more

Hi can you say a little more about what the intended field values are that you are trying to achieve? ... View more

Hi. We have Splunk case 3421789 opened for this bug. For us it is installing from rpm that fails. It is not an option to install from tar.     ... View more

So there's a bug with installing Splunk Enterprise 9.2.x and the universal forwarder on the same server, something that should work. I have opened a case with Splunk and requested them to document the issue in the known issues. They have not done that yet.  ... View more

Thanks @hrawat_splunk  The logs are as expected then 05-03-2024 17:46:52.999 +0000 WARN AutoLoadBalancedConnectionStrategy [24761 TcpOutEloop] - Current dest host connection 1.2.3.4:5678, oneTimeClient=0, _events.size()=993, _refCount=1, _waitingAckQ.size()=0, _supportsACK=0, _lastHBRecvTime=Fri May 3 17:46:48 2024 is using 475826 bytes. Total tcpout queue size is 512000. Warningcount=2001 ... View more

Hi. We just upgraded from 9.0.6 to 9.1.4 and are seeing these same warnings. Do we know that this was fixed in 9.1.4? ... View more

Hi. Have a look at  https://community.splunk.com/t5/Splunk-Search/Why-is-Lookup-definition-in-transforms-conf-not-returning/td-p/589334 Sounds like there's a lookup definition in a transforms.conf and the corresponding lookup file does not exist. You can use btool on the Splunk head to locate the setting. For example /opt/splunk/bin/splunk btool transforms list --debug | grep file   You can see all the lookup file definitions. ... View more

Thanks @isoutamo  ... View more

How about | eval MyNewField=Host+Domain ... View more

Hi.  So you tried | makeresults ns=project* | eval _raw="\"totalTimeTaken\":4" | rex field=_raw "\"totalTimeTaken\":+(?<Response_Time>\d+)" | stats avg(response_time)   And there are two problems. 1) the first makeresults .. I don't know what the ns=project* is. Here's the reference https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults 2) your rex is extracting the value into the field Response_Time but then use do stats avg on response_time in lowercase.  Case matters in Splunk field names. Here's what seems to work | makeresults=1 | eval _raw="\"totalTimeTaken\":4" | rex field=_raw "\"totalTimeTaken\":+(?<Response_Time>\d+)" | stats avg(Response_Time) ... View more

Hi. Your search is so close to what I do.. change search -> where   | tstats count where index=aws by host | table host | where NOT [| tstats count where index=windows by host | table host] ... View more

Glad to hear this is what you needed.    You can accept this solution to indicate the question was answered to your liking.  thanks! ... View more

Hi so how is are the events being split by Splunk? And do you have any props to tell splunk how to split the events? ... View more

Hi so what's the patching schedule? Every 28 days starting in Feb 1? ... View more

Have a look at Replicate a subset of data to a third-party system You can modify it and do something like this props.conf [your-sourcetype-here] TRANSFORMS-routing = routeAll transforms.conf [routeAll] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=yourIndexer,ThirdParty outputs.conf [tcpout] defaultGroup=nothing [tcpout:yourIndexer] disabled=false server=10.1.12.1:9997 [tcpout:ThirdParty] disabled=false sendCookedData=false server=10.1.12.2:1234   ... View more

Sorry I misread this as wanting a leading space. Ignore my answer. ... View more

Try using printf | makeresults | eval test=printf(" %s","this is a test") | table test ... View more