@juda The first two links are dead.   I'm really looking forward to this update. Great work!   The next big one on my company's list is having dynamic drill-down URLs that link to Splunk dashboards with those dynamic values. ... View more

Greetings @naagaraj , The default setting for new Windows Event Logs is to ingest all logs - including historical logs. When you deploy that, it's not surprising that space quickly fills as Splunk handles the backlog.  If you don't want historical logs, take a look at the current_only setting specifically for Windows Event Logs. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Windows_Event_Log_Monitor ... View more

Greetings @sanjubaba, See below for the two relevant pieces of documentation regarding setting index retention policies: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf   ... View more

Greetings @Marco, Take a look at this free, popular splunkbase app: https://splunkbase.splunk.com/app/4182. Everything you need should be in the description. Good luck! ... View more

Greetings @mooqie, Are you looking for a fully automated solution? If so, you'll need to do more work on your side. If you just want to display what you have in Splunk through telegram, this should be a good start: https://splunkbase.splunk.com/app/4030 ... View more

I'm not completely following what you're asking, but there are definitely some things to fix. When you use | makeresults, it automatically creates a _time field equal to the current time. That is the "time" field that you are trying to manipulate (which is the same for every row). What you're looking for is something like this:   | makeresults | eval _raw = "2021-02-17 09:09:50 Calculated ABC. Action took 100 milliseconds" | append [ | makeresults | eval _raw = "2021-02-17 10:09:50 Calculated XYZ. Action took 122450 milliseconds" ] | append [ | makeresults | eval _raw = "2021-02-17 11:09:50 Calculated ABC. Action took 10 milliseconds" ] | append [ | makeresults | eval _raw = "2021-02-17 12:09:50 Calculated XYZ. Action took 67543 milliseconds" ] | append [ | makeresults | eval _raw = "2021-02-17 14:09:50 Calculated ABC. Action took 11 milliseconds" ] | append [ | makeresults | eval _raw = "2021-02-17 15:09:50 Calculated XYZ. Action took 5 milliseconds" ] | append [ | makeresults | eval _raw = "2021-02-17 16:09:50 Calculated ABC. Action took 600 milliseconds" ] | rex field=_raw "Calculated (?<ACTION>[^\.]+)\." | rex field=_raw "Action took (?<DURATION>\d+) milliseconds" | eval time = substr(_raw, 0, 20) | eval _time = strptime(time, "%F %H:%M:%S") | eval time = strftime(_time, "%F %H:%M:%S") | sort 0 ACTION -DURATION | streamstats count by ACTION | where count <= 2 | stats list(DURATION) as "Top 2 Durations", list(time) as Time by ACTION   Keep in mind that _time should always be an epoch so you should keep your human-readable time in a non-_time field. That's why I seem to switch back and forth. As a side note, assigning the _time and the two rex statements should all be done at the sourcetype definition level. You should NOT actually be doing any of this in a search in production. https://docs.splunk.com/Documentation/Splunk/latest/Data/Createsourcetypes ... View more

I see, I see. How recent does the data need to be? Another option would be to combine the elements from my original post with a | loadjob as your base search instead.  If you do it that way, you would run the base search over the past month every hour? Every day? Only during working hours? It depends on your use case. Either way, the base search would not search anything at all. Instead, it would just pull the results from the latest scheduled search immediately, and then you could apply your filters to that data set. If you still need a time picker, you'd have to build a custom one that uses the where command instead.     ... View more

Greetings @klim, Correct me if I'm misunderstanding, but I doubt your search is so big that you can't do a "one-time" load into memory of the results, and then filter them in-memory instead of creating a new search to send back to the indexers. Below is a run-anywhere dashboard of what I'm talking about. The base search runs on dashboard load, however, changing either of the two drop-downs does NOT initiate any kind of reload. Instead, they filter the results that have already been retrieved by the base search. In my example, changing the time selector DOES require a new search because the time selector changes the base search itself.     <form> <search id="baseSearch"> <query>index=_internal | table _time index sourcetype source host component _raw</query> <earliest>$timeSelector.earliest$</earliest> <latest>$timeSelector.latest$</latest> </search> <description>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-accelerate-a-search-that-uses-values-from-a-dropdown/m-p/540310#M37024</description> <fieldset submitButton="false"> <input type="time" token="timeSelector" searchWhenChanged="true"> <label>Time Selector</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="sourcetype" searchWhenChanged="true"> <label>sourcetype</label> <choice value="*">All</choice> <default>*</default> <prefix>sourcetype="</prefix> <suffix>"</suffix> <initialValue>*</initialValue> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <search base="baseSearch"> <query>dedup sourcetype | fields sourcetype | sort sourcetype</query> </search> </input> <input type="dropdown" token="component" searchWhenChanged="true"> <label>component</label> <choice value="*">All</choice> <default>*</default> <prefix>component="</prefix> <suffix>"</suffix> <initialValue>*</initialValue> <fieldForLabel>component</fieldForLabel> <fieldForValue>component</fieldForValue> <search base="baseSearch"> <query>dedup component | fields component | sort component</query> </search> </input> </fieldset> <row> <panel> <table> <search base="baseSearch"> <query>search $sourcetype$ $component$</query> </search> <option name="drilldown">cell</option> </table> </panel> </row> </form>     If that doesn't help, let me know what I misunderstood, and I'll be happy to update my answer.  ... View more

Greetings @moguai , Take a look at this search. It should get you close to what you're after. Note that the eventstats and the stats will work by themselves without the other. I included both so you will have more options with manipulating your dataset. | makeresults | eval _raw = "req.begin \"Started... deviceId=\"12345\", request_id=\"1\"" | append [ | makeresults | eval _raw = ".... \"request_id=\"1\" deviceId=???" ] | append [ | makeresults | eval _raw = ".... \"request_id=\"1\" deviceId=???" ] | append [ | makeresults | eval _raw = ".... \"request_id=\"1\" deviceId=???" ] | append [ | makeresults | eval _raw = "req.end ... \"request_id=\"1\" deviceId=???" ] | reverse | rex "deviceId=\"?(?<deviceId>\d+)\"?" | rex "request_id=\"?(?<request_id>\d+)\"?" | eventstats values(deviceId) as deviceId by request_id | stats list(_raw) as events by request_id   ... View more

Greetings Mrig342,   Here's a run-anywhere search that should get you what you want. You'll just have to update it to fit your data. It's important that you end the search with a stats command. | makeresults | eval File_System = "\logs", Disk_Usage = "41" | append [ | makeresults | eval File_System = "\opt" , Disk_Usage = "73" ] | append [ | makeresults | eval File_System = "\var" , Disk_Usage = "69" ] | append [ | makeresults | eval File_System = "\apps", Disk_Usage = "48" ] | stats max(Disk_Usage) by File_System ... View more

Silly question, but did you restart Splunk after making the changes? ... View more

If your outputs.conf was set up properly and nothing was blocking it, the default _internal configuration still should have been sending. Regardless, glad you got it figured out! Please mark your answer as the accepted answer since that resolved the initial question in case anyone else comes across this. ... View more

That all looks good. I don't think it's an issue, but you only need [tcpout] & [tcpout:groupname] OR [tcpout-server://...]. Can you try it with just the last line in your file?   Also, can you manually check the forwarder's logs with that configuration? The crucial log file will be: C:\Program Files\SplunkForwarder\var\log\splunk\splunkd.log In particular, search for [ERROR] and [WARN], and TCPOutputProc. ... View more

Greetings @JakeK, It sounds like you're most of the way there! You clearly have gone through these steps in some way in order to get the deployment clients talking to the deployment server (your Splunk Enterprise instance). That is nice to have, but all the deployment server really does is hands out configurations to the clients and as you can see handles phoning home. This is data that goes mostly to the clients from 8089 (and minimal data comes back from the clients over the same port). You now need to configure where you want the forwarders' data to go. This will be a one-way trip from the forwarders to Splunk Enterprise over 9997. Here is the general documentation covering this, but I'll provide a quick-and-dirty example that should work with your case. On a test forwarder, create the file $SPLUNK_HOME/etc/system/local/outputs.conf. In it, define the following:       [tcpout-server://10.11.12.321:9997]       Here is the full documentation for outputs.conf: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf. You should be able to use any resolvable form (ip address, host name, or FQDN) of your Enterprise instance.  I'm not familiar enough with Azure, but I recommend using an internal IP/name just in case Azure charges egress for sending the data "externally." Once complete, restart splunk with $SPLUNK_HOME/bin/splunk restart. The data should come in quickly after the forwarder is restarted. P.S. Your warning is unrelated. I'm pretty sure all new Splunk installs show that when searching the internal index. ... View more