This usually happens when there are 0 results from the preceding search. If the results are more than 0 then you'll not see this error.   So its safe to ignore this. ... View more

I downvoted this post because spam ... View more

Try : https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html ... View more

Like anyone else, data from the particular host is more than 24hrs late. After restart, all that missing data appears and updated to latest time. ... View more

The Web page for forwarder is disabled. hence no means to get that popup. I'll try your suggestion of store local copy ... View more

parallelIngestionPiplines =3 I understand batch mode, but then a couple of times I have waited for 1-2 days for data to arrive and data only starts arriving after restart ... View more

how does this work for Splunk "Search" page. I am not able to implement this on Search Page. Implemented on all other dashboards ... View more

I guess this will help : https://community.mimecast.com/docs/DOC-2142 ... View more

This Query will give you All host sending data in last 7 days index=* earliest=-7d@d latest=now() | stats count by index, host, source, sourcetype This Query will give you all Host sending data in before 7 days index=* latest=-7d@d | stats count by index, host, source, sourcetype Try comparing both will give you new hosts added this week ... View more

You may do this by using props.conf and transforms.conf. -----------------props.conf--------------------- [index_A] TRANSFORMS-filter_A_events= filter_A_events [index_B] TRANSFORMS-filter_B_events= filter_B_events [index_C] TRANSFORMS-filter_C_events= filter_C_events ----------Transforms.conf-------------------------- [filter_A_events] REGEX = DEST_KEY = queue FORMAT = indexQueue [filter_B_events] REGEX = DEST_KEY = queue FORMAT = indexQueue [filter_C_events] REGEX = DEST_KEY = queue FORMAT = indexQueue If you are using HF to forward events, place these .conf files on HF. If you are using UF for forward events, place these .conf files on Indexer Hope this helps ...!!! ... View more

HI All, I had a similar issue in my environment. I just deleted $SPLUNK_HOME/etc/auth/ca.pem (Old Certificate) ...and then tried to start the splunk. Things worked fine for me. (Well do take backup before you delete) Regards, Neel Shah ... View more

HI .. If you do not want to install a forwarder, no problem. You may want to write a shell script to copy and replicate log files on your server (You may want to use script using SFTP/FTP) I wouldn't suggest receiving Syslog using port 514 simply because when you take your indexer down for patching, you'll lost the data. Hope that makes sense (That again depends on how critical is your data) Regards, Neel ... View more