ES Cannot be installed in a cluster on Windows, it only supports standalone ES search heads. https://docs.splunk.com/Documentation/ES/latest/RN/Limitations ... View more

One additional comments which haven't mentioned yet. There is upper limits for buckets in clusters (if I recall right both per node and per cluster). Normally this is not an issue, but if you have quite active site which have hundreds/thousands sources and TB/PB ingesting per day, you could hit those limits. ... View more

You're trying do dig out a thread from some 8 years ago. Most probably most of the participants are no longer actively following Answers. Your best bet would be to create a new thread and desciribe your problem there (possibly providing a link to this one if your case is similar. ... View more

This helped me combine the values of two multi-valued fields which was helpful.  I'm just trying to figure out how to combine 3 values now.  Basically one mvfield has attributes of things changed in a user account.  The second field has the old value of the attribute that's been changed, while the 3rd field has the new value that the attribute has been changed to.  attributes=group,role oldvalue=user,admin newvalue=superuser,null The 3 fields don't consistently have the same count of attributes so the dynamic method recommended certainly helped.  I'm just struggling to reverse engineer it to handle 3 multivalue fields.  Any suggestions? ... View more

This config will not take effect if there is cached user config overriding it, like @ltrand says.  Wipe out this directory for each user will work but it removes user search history etc. Also, after removing directory or config, a restart is needed. A more controlled way would be only to remove the affected stanza. For example user Bart have used the Search app but not the MyOwnApp. Then these config changes wiil take effect for app MyOwnApp but not for the Search app. To have this change take effect for Search app as well, do this: -bash-4.2$ pwd /opt/splunk/etc/users/bart/search -bash-4.2$ ll total 0 drwx------ 2 splunk splunk 52 Nov 24 08:08 history drwx------ 2 splunk splunk 26 Sep 24 22:03 local drwx------ 2 splunk splunk 23 Sep 24 22:03 metadata -bash-4.2$ ll local/ total 4 -rw------- 1 splunk splunk 9 Sep 24 22:03 ui-prefs.conf -bash-4.2$ cat local/ui-prefs.conf [search] -bash-4.2$  Remove the search stanza header and restart splunk. ... View more

suggestion - somesoni2 - you should move this comment to an answer so that ltrand can accept it. ... View more

Just to update, if anyone want to move mutiple knowledge objects from one app to another then it'll be pain in Splunk WebGUI because you need to move knowledge object one by one, to simplified this I have created python script which uses Splunk REST API to move multiple knowledge objects https://github.com/harsmarvania57/splunk-ko-change (NOTE: Please use that script at your own risk :P) ... View more

Hi ltrand, this basic run everywhere search will match all fields that end with .MD5 and get the value into a new field called md5 | gentimes start=-1 | eval myRaw="root.sub1.sub2.objectname.MD5=foo root.sub2.objectname.MD5=boo root.objectname.MD5=baz" | rex max_match=0 field=myRaw "\.MD5=(?<md5>[^\s]+)" | table md5 The first and second line is only needed to create some dummy events, so you won't need it. Tweak it as needed to match your events. Hope this helps ... cheers, MuS ... View more

I downvoted this post because this can be done with route and filtering: http://docs.splunk.com/documentation/splunk/6.4.3/forwarding/routeandfilterdatad ... View more

Have you tried adding the following to your query? splunk_server=local For instance, who am I? | rest /services/authentication/current-context splunk_server=local | table username I remember getting weird results when running REST queries on the DMC server and forcing the queries to run against the local server fixed the problem ... View more

I do not see any way that a base search can be limited at all. Please educate us on this limit! ... View more

Thanks for the clarification, I wasn't reading the documentation right on that. ... View more

I also had same issue while upgrading ES from 3.3 to 4.1. ./splunk search '| testessinstall' worked for me. Awesome and thanks for the workaround. ... View more

Thanks all for your answers. It is possible to put a value in the _key field ? for Example my technical key... I cannot see an exemple anywhere. Thanks in advance. ... View more

You'll want to look for the props.conf inside of any app that is picking up the source /home/centos/debug_vars.log. That app should be configured on everything from the forwarder to the final indexer where the data will sit. If you only do the forwarder, then the indexer, not knowing any better, will then use its default setting for ingestion. Which app props.conf you change doesn't really matter, with the exception of "don't edit anything in default". It's just there to help us manage precidence and make it easier for us humans. The system will rollup all of the props into a single running config at start. I generally make sure that end-to-end data handling is done within a single "app" so that it's easiest to troubleshoot. If you looked into your splunk logs, you'll probably see a bunch of truncation messages, though the logging is not the most verbose or easy to use. I have not found a way to easily debug props/transforms/inputs issues other than getting very familiar with reading Splunk's internal logs. ... View more

If you ARE required to show all the individual days of data, you can try this: index=csl_dblogs | rename TRUNC_CREATION_TIME as Date | rename SOURCE_SYSTEM_NAME as Source_System | eval Date=strftime(Date, "%m-%d-%Y") | stats count as Count by Source_System Date | eval Today=strftime(now(), "%m-%d-%Y") | eval TodayCount=if(Date=Today,Count,0) | eventstats sum(TodayCount) as TodayCount avg(Count) as AvgCount sum(Count) as Total list(Date) as Dates list(Count) as "Daily Count" by Source_System | eval AvgCount=round(AvgCount,2) | eval Difference = round(((AvgCount - TodayCount) /AvgCount)*100,2) | where Date=Today | table Source_System Dates "Daily Count" Total AvgCount Today TodayCount Difference ... View more

You can use this approach: https://answers.splunk.com/answers/73966/query-for-picking-time-range-at-specified-time-everyday.html In your case it would look more like.. "date_hour=6 AND date_minute>0 AND date_minute<30". Keep in mind this will need to go in the beginning of the search, just like the earlier example. ... View more

I assume that the error message is appearing in the splunkd.log on a forwarder. "Unable to send handshake message to deployment server. Error status is: not_connected" I also assume that all the forwarders are sending their internal logs to the indexers - that there is nothing wrong with the forwarding, just the deployment process. Hopefully, the deployment server is also forwarding its internal logs to the indexers, so you can see the overall picture from just one place. If yes, here are some searches to play with This search summarizes the "phone home" attempts of the forwarders index=_internal (*phonehome* component=DC*) OR (component=DC:HandshakeReplyHandler) | bin span=1d _time | stats count by host log_level _time This search summarize the "received phone homes" from the perspective of the DS index=_internal metrics group=deploy-server sourcetype=splunkd | bin span=1d _time | stats sum(nReceived) by host _time In addition to looking at these statistics, take a look at the events themselves. You will probably see other reports that would help you see the problem. Some timecharts might help you determine if the DS is getting too many requests at once, for example. ... View more

Thanks, that got me there. |dbinspect index=main | eval span=tostring((endEpoch-startEpoch), "duration") | eval start_time=strftime(startEpoch,"%y/%m/%dT%H:%M:%S") | eval end_time=strftime(endEpoch,"%y/%m/%dT%H:%M:%S") | table start_time,end_time,span,modTime,state,sizeOnDiskMB,rawSize,eventCount,sourceCount,sourceTypeCount,splunk_server,path ... View more

That works awesome! Thanks! ... View more

Depending on your Splunk licenses plan (Enterprise or free) you have 3-5 overages respectfully before you are unable to search anymore. Are you sure that you just didn't start indexing more data rather than it being a Splunk error? Go to Settings/Licensing/Usage Report then click on Previous 30 days.. Split by Index, source type, host etc.. Hit the search button and choose your timeframe as Today and verify that you're not indexing more data then you thought you were. Once you do this and verify your not indexing more data then you can open a ticket with support ... View more

Thanks, I didn't realize the default admin was limited in searching! ... View more

I got rid of the HTML Tags using 4SED statements to get rid of all the HTML tags & formatting: rex field=SOLUTION mode=sed "s/&q u o t //g" ->(without spaces) rex field=SOLUTION mode=sed "s/<[^>]*>//g rex field=SOLUTION mode=sed "s/- - & g t//g --> (without spaces) rex field=SOLUTION mode=sed "s/& g t//g --> (without spaces) ... View more