https://ideas.splunk.com/ideas/PLECID-I-670 ... View more

Give this a try: index=main model! = iphone [search index=main model = iphone so = 9. *  | table UserId | dedup UserId | table UserId | format] ... View more

In the License Usage Previous 30 days tab, there is a report Average and Peak Daily Volume that provides the avg volume and peak.  You can compute what a surge value would look like and alert on that value. Add something like  | eval surge=avgVolumeGB*1.25 Or perform a calculation of peak compared to average and alert on that threshold. ... View more

Try adding the | format command in the subsearch https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/FORMAT This command takes the results of a subsearch, formats the results into a single result and places that result into a new field called search. index=ind1 [search sttring 1 | table correlationId | format] ... View more

https://splunkbase.splunk.com/app/3110/ Version 4.1.3 May 13, 2021 * Fix for customers seeing AADSTS7000215: Invalid client secret is provided for EventHubs Inputs In the data inputs for the app: Make sure you're using the FQDN On the Azure side: Make sure the role is eventhub data receiver on Azure configuration side. ... View more

I had a customer with the same issue. They are on Windows environment. From the web_service.log error:133 - Masking the original 404 message: ‘The path ‘/en-US/static/@C07E38B2C61DCE7D4C565937648843078F1F9808DDC3298053487F8B847B84A3/build/css/bootstrap-enterprise.css’ was not found.' with ‘Page not found!’ for security reason Turns out remove this app Microsoft Office 365 Reporting Add-on for Splunk (TA-MS_O365_Reporting) resolved the issue ... View more

Since every customer is unique, I would create a support case for this issue, provide diags and the list of buckets that is corrupted. Provide how the index cluster is set-up. e.g. single site with 3 indexer and replication factor of 2. Depending on the replication factor, if the bucket is corrupted and it's a replicated bucket, rb_epochendtime_epochstarttime_bucketid_guidofindexer You might be able to move the bucket to the temp directory. Enable maintenance mode on cluster master, restart of the indexer, then disable maintenance mode and the cluster master should tell the index cluster to create another copy. ... View more

You can find a list of forwarders in the monitoring console under Settings, monitoring console (or DMC for older versions), then select Forwarders, Forwarders: deployment. In the Status and Configuration section, open the report in search (magnifying glass icon). Once in the search mode, you can adjust the search query to your specific needs and Save As an alert. ... View more

Sounds like the data is being deleted due to either the size of the index or frozenTimePeriodInSecs. You can check the data time stamp from the UI under settings, Indexes. Check the index and the earliest event. ... View more

You can also try restarting the cluster-master. This should clear up any stale fix-up tasks. ... View more

https://docs.splunk.com/Documentation/Splunk/7.0.2/ReleaseNotes/Knownissues SPL-148514 - Splunk not starting on kernel version 4.13.0-31 ... View more

Give this a try: blacklist1 = EventCode="4662" Message="Object Type:(?!\s*(groupPolicyContainer|dnsNode))" ... View more