I have the same issue.  But starting splunk with root doesn't work.  Firewall is not running. I got a new Certificate and created a new PEM files.  No errors in the logs.  Just keep waiting on the startup of the HTTPS. Any suggestions? ... View more

Like this: host="myhost" | where id!="" | lookup sp_aliases id OUTPUT myid | eval numeric=mvfilter(match(myid, "^[^@]+$")) | eval email=mvfilter(match(myid, "@")) | eval theId=coalesce(numeric, email, id) ... View more

I think I'm having a similar issue, we have an Apache2 reverse proxy in front of our Splunk instance, what type of setting did you configure to allow the HEC explicitly? ... View more

Since the free license does not seem to include report scheduler, I had to setup a crontab entry such as 0 0 * * * root /opt/splunk/bin/splunk search '|savedsearch "Job to update sp_aliases lookup"' >/dev/null 2>&1 ... View more

I arrived at an intermediary form of my query host="sp.dentfix.ro" | stats values(event) as step values(eval(strftime(_time, "%Y-%d-%m %H:%M"))) as times by id | mvcombine step | stats count by step Here I would like to group by id and all oldId fields of the id. Is a subquery working in place of group by id field? ... View more

There is actually another way to do this and to me it is easier to understand, try: event=Payment | timechart span=1d sum(value) as Earnings | predict Earnings future_timespan=31 | where _time<=relative_time(now(),"+1mon@mon") ... View more

Thank you rvencu. Worked like a charm. ... View more

Thanks. There is a great answer to that here: https://answers.splunk.com/answers/443865/predict-values-by-end-of-current-month.html#answer-443874 ... View more