Hi Gurav , Please find our configuration below ... View more

sure i will share ... View more

But what are the configuration needed to bring the data into Splunk from mangodb ... View more

(MethodExecutionInfo|DebugInfo|CacheRefreshInfo|.currency.)((\d{8})-(\d{2})).txt Got the answer from slack ... View more

now we are in 6.6.2 the funny part here is still i am seeing below message New maintenance version available. Click here for details. New version available. Click here for details. This is something ***** ... View more

Index=internal sourcetyp=* | stats count by clientip,user ... View more

Is it possible to export multiple tables from on dashboard to excel,With the stock version of the above method, probably not. You may be able to create some customer javascript that could do it. ... View more

Is it possible to export dashboard with multiple tables into Excel ... View more

Working fine? ... View more

One more option | fields - status ... View more

| table requiredfield1 requiredfield2 requiredfield3 You can keep required fields by using thid ... View more

base search | search tokan1="$A$" OR tokan2="$B$" OR tokan3="$C$" ... View more

|from datamodel foo.fooo | search Counterparty="abc" OR TransactionType="xyz" ... View more

New version has drill down in UI that would help you ... View more

select none in email security and try ... View more

Enable SSL? ... View more

you can use date and time rand which is available in time picker right? ... View more

Not sure if below answer may help you You can check the duplicated events along with their tim of indexing with the below query: index=your index sourcetype=your sourcetype | eval dup=_raw | convert ctime(_time) as T1 | convert ctime(_indextime) as indextime | transaction dup mvlist=t maxspan=1s keepevicted=true | table dup,source,sourcetype,host,index,indextime Process to delete the duplicated events: Run the following command to store all duplicate events in a lookup table. index=* sourcetype=wsa_accesslogs | eval id=_cd."|".index."|".splunk_server | transaction _raw maxspan=1s keepevicted=true mvlist=t | search eventcount>1 | eval delete_id=mvindex(id, 1, -1) | stats c by delete_id | outputlookup delete_these.csv Once search finishes completely by running the following command you can view the events stored in lookup table | inputlookup delete_these.csv Note: You need to wait till your search gets complete. You can use smart mode as well. You can also check the newly created lookup table in the $Splunk_Home\etc\apps\app_name\lookups\ delete_these.csv Run the following command to delete all events from source type which also exists into lookup table (in your case its delete_these.csv) index=* sourcetype=wsa_accesslogs | eval delete_id=_cd."|".index."|".splunk_server | search [|inputlookup delete_these.csv | fields delete_id | format "(" "(" "OR" ")" "OR" ")"] | delete ... View more

You can check the duplicated events along with their time of indexing with the below query: index=your index sourcetype=your sourcetype | eval dup=_raw | convert ctime(_time) as T1 | convert ctime(_indextime) as indextime | transaction dup mvlist=t maxspan=1s keepevicted=true | table dup,source,sourcetype,host,index,indextime Process to delete the duplicated events: Run the following command to store all duplicate events in a lookup table. index=* sourcetype=wsa_accesslogs | eval id=_cd."|".index."|".splunk_server | transaction _raw maxspan=1s keepevicted=true mvlist=t | search eventcount>1 | eval delete_id=mvindex(id, 1, -1) | stats c by delete_id | outputlookup delete_these.csv Once search finishes completely by running the following command you can view the events stored in lookup table | inputlookup delete_these.csv Note: You need to wait till your search gets complete. You can use smart mode as well. You can also check the newly created lookup table in the $Splunk_Home\etc\apps\app_name\lookups\ delete_these.csv Run the following command to delete all events from source type which also exists into lookup table (in your case its delete_these.csv) index=* sourcetype=wsa_accesslogs | eval delete_id=_cd."|".index."|".splunk_server | search [|inputlookup delete_these.csv | fields delete_id | format "(" "(" "OR" ")" "OR" ")"] | delete Happy Splunking ... View more

We have done the following things after doing R & D. 1.Changed date range from real time to today. 2.Set dashboard refresh time to every 5 minutes. 3.Summary indexing 4.Report acceleration 5.Scheduled this search every 5 minutes so it will save in the cache. 6.Search query optimization. 7.Auto restart splunk daily at 2:00 AM UTC so that memory will be released. 8.Set high priority to this dashboard. 7.Set high priority to this scheduled search. 8.Run stats tables first then start charts. 9.Changed the delimer of raw data from text files method to new way which will reduce the time while converting raw data to fields of delimiting proccess. 10.Reduce the number of indexes and source type After all this my dashboards loading time reduced from 3 minutes to less than 10 seconds. Super fast ... View more

We have done the following things after doing R & D. 1.Changed date range from real time to today. 2.Set dashboard refresh time to every 5 minutes. 3.Summary indexing 4.Report acceleration 5.Scheduled this search every 5 minutes so it will save in the cache. 6.Search query optimization. 7.Auto restart splunk daily at 2:00 AM UTC so that memory will be released. 8.Set high priority to this dashboard. 7.Set high priority to this scheduled search. 8.Run stats tables first then start charts. 9.Changed the delimer of raw data from text files method to new way which will reduce the time while converting raw data to fields of delimiting proccess. 10.Reduce the number of indexes and source type After all this my dashboards loading time reduced from 3 minutes to less than 10 seconds. Super fast ... View more