We installed the Grand Central 3.0.7 add-on installed in our Splunk Cloud environment and were working on configuring it for our AWS Master Account…We got through the first several steps and since we were seeing it pull in the AWS accounts, we were pretty happy that things were working….then we got to the AWS Stacksets…and it looks like AWS Organizational Units only show up if those OUs are off the root OU and also that OU contains an AWS account.  In our environment, we have OUs that are nested within other OUs and our AWS accounts reside in the child OUs.  Here is what we found: Notice in this Grand Central dialog, only the ‘Security’ and ‘Infrastructure’ OUs show up in the drop-down: See in this AWS OU screenshot, most of the OUs in AWS did not show up in the Grand Central AWS OU drop-down. The ‘Business Units’ OU is one that contains child OUs whose child AWS accounts we would want to be managed/collected via Grand Central.  Notice the OU named ‘Security-old’…it only has a “grandchild” AWS account (a child of the ‘GC-Testing01’ OU) and no AWS account is directly contained within the ‘security-old’ OU.   To test, we moved the ‘security_acct’ AWS account from the ‘Security-old / GC-Testing01’ OU to the ‘Security-old’ OU….and then after refreshing things in Grand Central, it shows up in the drop down.    Here is the OU structure that we found will work in Grand Central (Notice that the ‘security-acct’ AWS account is now in the ‘security-old’ OU (right off the root):  Notice above, the ‘security_acct’ AWS account is now contained directly within the ‘Security-old’ OU. I need to find a way to get Grand Central to work with the way we have structured our OUs and AWS accounts.  I am told we have structured our OUs generally following the recommended best practices from AWS: https://aws.amazon.com/blogs/mt/best-practices-for-organizational-units-with-aws-organizations/ I’m looking for any guidance on next steps forward for us to be able to push stacksets to all our AWS accounts as they lay in their nested OUs.  Any thoughts or ideas? Thank you, REID ... View more

I wish to take a stacked bar chart, use 'addtotals' to create a field representing the cumulative value of the stacked bars, and then overlay a prediction (using predict) of the cumulative value on the stacked bar chart.  When I try to do this, the stacked bars always revert to side-by-side in the chart.  Here is a look at what I wish to do: some SPL that generates a sample dataset:     | makeresults count=20 | streamstats count AS count | eval _time=now()+(count*43200) | eval n=(random() % 1000000) + 1 | eval load=100*count*n | eval host_name=if(count%2==0,"host1", "host2") | timechart span=1d avg(load) AS load by host_name | addtotals host* fieldname=load_total     If I create a visualization of this, stack the bars, and add the 'load_total' field as an overlay, I end up with something like this:   Now, I wish to add 'predict' to this query to get forecasted values for the cumulative 'load_total' field.  Here is the SPL for that:     | makeresults count=20 | streamstats count AS count | eval _time=now()+(count*43200) | eval n=(random() % 1000000) + 1 | eval load=100*count*n | eval host_name=if(count%2==0,"host1", "host2") | timechart span=1d avg(load) AS load by host_name | addtotals host* fieldname=load_total | predict load_total algorithm=LLT future_timespan=4     Even though the bars are set to be stacked in the format of the chart, they revert to side-by-side. Any ideas on why the behavior is like this or how I can get the stacked bars? I believe what I am trying to do is the same as in this post from @renuka , but I wanted to add a little more information. Thanks, Reid ... View more

In my testing, I am very impressed by the TrackMe app.  It is very full featured and very mature.  Thank you for your efforts in delivering it to the Splunk Community! One need we have in our environment is monitoring the contents of lookups.  I would love to be able to do this within TrackMe as well...is there a trick to maybe getting this to work today?  I played around with 'inputlookup' with 'raw' and 'from' search types in elastic data sources, but I am not really seeing a way to implement. Does anyone have any ideas on how/if TrackMe might be able to monitor lookups as well? Thanks, REID ... View more

Does anyone have any experience running the Isilon App on Splunk 7.2? I notice on the Splunkbase page for it (https://splunkbase.splunk.com/app/2688/) that 7.1 is listed as compatible, but not on 7.2 yet. The Isilon Add-on lists 7.2, but not the App. I would guess the App is likely fine on 7.2, just hoping someone else out there has had some experience with it on the newer Splunk version. Additionally, if someone knows if Crest Data Systems (the author) is planning to update the compatibility to list 7.2, that'd be great too! Thanks, REID ... View more