So, of the suggested searches, only this one (swong_splunk) extracts the results (correct?): tag=Operativo NOT(SO=ios AND VersSO="9.*") | dedup IdCliente | search [search tag=Operativo (SO=ios AND VersSO="9.*") | table IdCliente | dedup IdCliente | table IdCliente | format] This search extracts all customer codes that use ios 9. * but have also used a different device. I would need the opposite, that is, only customers who have used exclusively ios 9. * (but I can get them by difference from the list of those who use ios 9. * minus the search list above)   This research does not extract anything: tag=Operativo | eval iphone9=if(SO=ios AND match(VersSO,"9\..*"),"Yes","No") | stats count(eval(iphone9="Yes")) as iphoner dc(model) as modelcount by  IdCliente | search iphoner>0 | sort IdCliente ... View more

Thanks for your inputs @swong_splunk  . I was trying somethings as below with outlier however it is not working as it should . index="_internal" source="/opt/splunk/var/log/splunk/metrics.log" group=per_index_thruput series=** splunk_server=* earliest=-61m@m latest=-1m@m |rename series as index| eval GB=kb/(1024*1024) | bin _time span=1m | stats sum(GB) as size by _time index | streamstats avg("size") as avg stdev("size") as stdev by "index" | eval lowerBound=(avg-stdev*exact(3)), upperBound=(avg+stdev*exact(3)) | eval isOutlier=if('size' < lowerBound OR 'size' > upperBound, 1, 0) |eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p")| fields index time size ... View more

https://splunkbase.splunk.com/app/3110/ Version 4.1.3 May 13, 2021 * Fix for customers seeing AADSTS7000215: Invalid client secret is provided for EventHubs Inputs In the data inputs for the app: Make sure you're using the FQDN On the Azure side: Make sure the role is eventhub data receiver on Azure configuration side. ... View more

/opt//splunk/etc/system/local/props.conf on the indexer suffice ---- this should be fine. [/var/log/lighthouse/*.json] ----- You can mention sourcetype of those files mentioned here instead of default OR [/var/log/lighthouse/.json] ----- If you want to use source path over there , you need to use the below: [source::/var/log/lighthouse/.json] ... View more

Since every customer is unique, I would create a support case for this issue, provide diags and the list of buckets that is corrupted. Provide how the index cluster is set-up. e.g. single site with 3 indexer and replication factor of 2. Depending on the replication factor, if the bucket is corrupted and it's a replicated bucket, rb_epochendtime_epochstarttime_bucketid_guidofindexer You might be able to move the bucket to the temp directory. Enable maintenance mode on cluster master, restart of the indexer, then disable maintenance mode and the cluster master should tell the index cluster to create another copy. ... View more

Sounds like the data is being deleted due to either the size of the index or frozenTimePeriodInSecs. You can check the data time stamp from the UI under settings, Indexes. Check the index and the earliest event. ... View more

Any chance this can be added to the release notes? We have had a number of engineers waste a lot of time trying to identify the cause of this issue. If they had seen this on the release notes page they would not have wasted a day or two trying to identify the problem. https://docs.splunk.com/Documentation/Splunk/7.1.1/ReleaseNotes/Knownissues#Data_model_and_pivot_issues ... View more

https://docs.splunk.com/Documentation/Splunk/7.0.2/ReleaseNotes/Knownissues SPL-148514 - Splunk not starting on kernel version 4.13.0-31 ... View more