@prakash007 You posted this over a year ago but I'd like to know if you managed to solve this issue? I've similar setup and getting HTTP 502 Bad Gateway ... View more

I haven't specifically worked on this Add-on but just adding a cert somewhere won't be enough. You'll need to refer to it in a conf file. I'd start by looking at the app doc (if any) or the code to see if it mentions what config file to use. ... View more

In particular just from the saved reports and dashboards? ... View more

Runals I can't thank you enough for the explaination. It makes perfect sense to me now. One more question. Is it possible to limit this search to only look for all the searches run against a particular index? ... View more

Runals thanks for taking your time to reply in detail and put together the search which I need. Much appreciated! I'm still learning splunk so don't understand few things in your search so would you please be able to explain each of these briefly? | rex field=search "^'(?.+?\|)" | rex field=foo max_match=0 "(?:\s|\()(?\w.+?)(?:!=|=)" | rex mode=sed field=field "s/(OR |NOT |\()//g" | mvexpand field Thanks ... View more

Thank you, that's exactly what I was looking for! My next question which I hope you can help. Would it be possible to re-write the date timestamps its giving in the output? Timestamp is like 2016-09-03T13:00:00.000. I want to re-write them so it displays just the hour for example 13:00 or 13h. In the chart you can't read the time unless you hover your mouse over a part of the chart. Thanks. ... View more

Sundar thanks for providing the name of the app. I've downloaded it in my staging environment so would play with it. I think this is the sort of app I was looking for. ddrillic I'll be upgrading to 6.4.2 pretty soon (at least in the staging environment) to utilise the tsidx reduction feature so I'll look at the extra functionality introduced in the DMC. Thank you both 🙂 Now my next question, is it possible to create create dashboards on search heads which can be accessed by let's say power users? I want these dashboards to show the performance of Splunk. ... View more

Tony thanks for providing the required configuration. I've managed to get the selective fields extracted at index time and the rest at search time. Now my next issue.....we currently have a search which creates a field at search time and it works against the index which has all fields extracted at index time but its not working when run on the new index I've created. What am I missing? Search is index=mynewindex level=debug | rex field=message ".value_to_be_extracted." | fields + newfield earliest latest When I run this search on the current index it works and creates new field but I don't get the new field when its run on the new index. Though in both cases I'm getting same number of events so data is there and its searching it but just not creating the field. ... View more

Thanks shaskell. I'll read the provided documentation and would implement it accordingly in my test environment. I don't expect the CSV file to ever change. I'm hoping by extracting couple of fields which get used quite often at index time would speed up our searches and at the same time, it'll keep the index size to the minimum. The fields which I'd like to extract have limited number of values so tsidx files won't be huge. ... View more

This is how I've achieved this on Splunk 6.3.3: My web-proxy conf: ProxyPass /splunk http://myVIP.com:8000/splunk ProxyPassReverse /splunk http://myVIP:8000/splunk My inputs.conf on Search Heads $SPLUNK_HOME/etc/system/local: [default] host = upsks01b host = VIPurl web.conf on Search Heads $SPLUNK_HOME/etc/system/local [settings] root_endpoint = /splunk What version of Splunk are you running on Search Heads? ... View more

Happy New Year everyone. I hope someone would be able to provide me an answer. ... View more

I've been looking at this issue again today and I think Licence master isn't forwarding data to the indexers. How did I come to this conclusion? If I run this command for "Previous 30 days" licence history I get nothing and this is the built-in command: index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach However if I modify it by adding splunk_server=local then it works and gives me data for last 30 days. index=_internal splunk_server=local source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach I'm assuming when I go to Previous 30 days tab, it searches the index=_internal on indexers (we've got 3 right now) but it doesn't find anything specific to licencing because its not forwarding anything to those indexers? If that's the case how could I forward its internal logs to the indexers. As per the above answer its a best practice solution. Thanks for all your help so far! ... View more

Thanks for getting back to me so quickly. I've got Cluster Manager, can I use that as a 3rd Search Head? Thanks ... View more

I've resolved the issue. Our Python script was generating sub-directories under the monitored directory and all the files were getting saved under those sub-directories. Getting rid of those sub-directories has sorted the issue out. Thanks for all your help everyone. ... View more