Hey hgarnica, i have the same issue, like i was not able to run the search from powerbi, what type of modifications or permissions i need to provide and how will be the sample url for connecting the splunk as i was using it with https://hostname:8089 --> do we need to give any specific app names like that. Thanks in-advance for awaiting for your response. ... View more

i tried couple of time for the same error but seen the same error. after that i tried above work around   $SPLUNK_HOME/etc/apps/ForensicInvestigator/default/data/ui/views iconv -f UTF-16LE -t UTF-8 portsservices.xml -o portsservices1.xml i removed the old file and renamed the portsservices1.xml to portsservices.xml and it worked for me  after that i started the splunk everything is working as expected. ... View more

in this way i am not getting the error count it is showing as application_name count percent abc,196,0.498575 ... View more

ya i agree with you thats what i am asking is there any chance to get the correct percentage ... View more

i need to add the application_name value as all abc as one value and all xyz as one value application_name errors count percent abc 0, 24, 92.307692 abc 1, 2, 7.692308 xyz 0, 64, 81.012658 xyz 2, 7, 8.860756 this is what i am geeting i want to add (abc + abc)application_name and i want to display the percentage, i hope you understand the request ... View more

yes suksien there are no white spaces. index= |top "error" by application_name application_name errors count percent abc 0, 24, 92.307692 abc 1, 2, 7.692308 xyz 0, 64, 81.012658 xyz 2, 7, 8.860756 ... View more

index=**** |top "error" by application_name application_name errors count percent abc 0 24 92.307692 abc 1 2 7.692308 xyz 0 64 81.012658 xyz 2 7 8.860756 ... View more

That Java processes are created by rules engine rules engine is used by grouping policy In this case we have to go to the scheduled search and there we have ITSI_Event_grouping we need to kill this job so it will again restart the job then our CPU comes down ... View more