Recently I have created a KVlookup using transforms .conf and collection.conf to get data from API. When KVlookup is manually opened, we can see the data but when searching on search head using inputlookup, it doesn't show anything. Permissions has also been granted. Is there anything else, which we are missing? ... View more

Is any one using Alert manager 3.x on Splunk ES 8.x and is it working properly.   we tried upgrading alert manager from 2.2 to 3.1 on Splunk ES 8.1 but its not working properly ( Alert are not getting converted from "new" to "auto_assigned" . After checking with Splunk they are recommending to migrate from "Alert manager" to "Alert manager Enterprise".   Can some one suggest on this please? Thanks ... View more

Requirement is to fetch values for all agentName and put it in a field.   Tried - 'agentName':\s(?<agentname>.*?,) but it pulls only first occurence.  Below is sample:   0,1,"[{'active': 0, 'metricsAtStart': 'Jitter: 193.6 ms', 'metricsAtEnd': 'Jitter: 98.8 ms', 'agentId': 280961, 'agentName': 'BR15CORPTE01', 'dateStart': '2023-07-19 18:27:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=280961'}, {'active': 0, 'metricsAtStart': 'Jitter: 194.2 ms', 'metricsAtEnd': 'Jitter: 1.9 ms', 'agentId': 294526, 'agentName': 'US06CORPTE01', 'dateStart': '2023-07-19 18:23:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294526'}, {'active': 1, 'metricsAtStart': 'Jitter: 100.2 ms', 'metricsAtEnd': '', 'agentId': 294566, 'agentName': 'US22CORPTE01', 'dateStart': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294566'}, {'active': 0, 'metricsAtStart': 'Latency: 209 ms', 'metricsAtEnd': 'Latency: 142.9 ms', 'agentId': 337436, 'agentName': 'AR06CORPTE01', 'dateStart': '2023-07-19 18:26:00', 'dateEnd': '2023-07-19 18:27:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=337436'}]",194913203,2023-07-19 18:22:00,"[{'rel': 'related', 'href': 'https://api.thousandeyes.com/v6/tests/3271565'}, {'rel': 'data', 'href': 'https://api.thousandeyes.com/v6/net/metrics/3271565'}]",https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203,((avgLatency > ... View more

Hi, I have a lookup table where column names are with weekdays (like monday, tuesday, wednesday,...) and have possible values as 1 and 0 only. What I want to achieve.. ...some query | eval day=strftime(now(),"%A") | where 'day'=1 but this doesn't seems to be working. Any idea how to search dynamic fields.   Thanks ... View more

we have upgraded splunk Enterprise to 8.1 and Alert manager to 3.1.11. After upgrade, alerts are not getting auto assigned and keeps on sitting with "new" status and hence not getting processed.   Any leads to this problem will be appreciated. Thanks ... View more

Any one have used this App. I am trying to download and  configure this app but every time receive "404" error. Below is the link trying to follow: https://docs.splunk.com/Documentation/NetApp/2.1.91/DeployNetapp/InstalltheSplunkAppforNetAppDataONTAP Any assistance please? Thanks Sushant ... View more

Need to monitor a website which when gets hit shows a popup with Username and Password. Tried below possibilities till now. 1. Used Website input App but in "Enter Credentials" page , it throws "Username and Password field name not detected" Error. 2. Tried passing credentials using below but getting unauthorized error. https://URL/insecurelogin?loginType=splunk&username=EMEA\abc&password=XYZ https://URL/insecurelogin?username=EMEA\abc&password=XYZ Any one has done such monitoring , please share your valuable inputs. Thanks ... View more

HI Experts,   we have 4 physical indexers in cluster and since few days /splunk file system storage has reached to threshold on 2 out of 4 indexers. Is there any way to equally distribute the storage load on all of the 4 indexers? Does data rebalancing option help here? ... View more

Hi, I am trying to pull a data from a csv through deployment app but only the field names are getting indexed , data is not getting indexed. Number of records in csv is around 70000. Tried through dbconnect but from there also same issue. Is there any limit of data which can be indexed at a time. If yes, where can that be verified? Thanks   ... View more

Hi , we have 7 SH in cluster and out of which for one of the SH KV store replication status is showing as "recovering". I tried 1.  doing rolling restart 2. resnync the stale KV store member but unfortunately status s still "recovering". If I run  this command --> splunk clean kvstore --local what impact does this command is going to make. Am i going to lose any data? please suggest. Thanks ... View more