Hello. Currently, SH's Enterprise core version is 9.2.7. I'm performing daily kvStore backups on SH using the following command: ./splunk backup kvstore -archiveName "archiveName" -auth user:'password' I confirmed that the above command successfully backs up kvStore, even though the user password is different. I can't find the -auth option in the kvStore documentation for Enterprise 9.2.7. the -auth option doesn't apply to kvStore backups in version 9.2.7? If anyone has had a similar experience or has resolved this issue, please help Thank you 🙂 ... View more

Hi all. I have one SHC with 3 search heads I thought if I create a HEC using web gui in specific memer, others were replicated HEC But NOT how should I do to fix that? my SHC member have replication_port = 9887 in server.conf ... View more

Hey guys. I'm a beginner of Splunk  I have a one question.  I  get a input value but value has a space. so I want to remove it here's my code   <input type="text"  token="field55">      // field55 is 'temp token' <lable>test </lable> <change> <eval token="field5"> trim($value$)</eval> // field5 is 'real token' </change> </input> ..... <query> index=mail    mail_sender= "$field5$" |  table mail_sender  </query>   if I input like 'test123  '  the result value is 'test123' (no spaces)  how can I do that??  So sorry hard to read please help me out!! ... View more

Hi all I want to add new line in dashboard title tag for instance, <table> <title> hello world</title> </table> result value is below hello world Is it possible thing? Thanks all ... View more

Hi all I'm testing sendemail command but it's not sending email. here's my search code index=main | table _time | sendemail to=tkdguq0110@gmail.com subject=sendemail_test server=mail.google.com and here's a log above 2020-05-04 19:32:27,700 +0900 ERROR sendemail:1435 - 'utf8' codec can't decode byte 0xbf in position 14: invalid start byte Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 1428, in results = sendEmail(results, settings, keywords, argvals) File "C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 474, in sendEmail errorMessage = str(e) + ' while sending mail to: ' + ssContent.get("action.email.to") UnicodeDecodeError: 'utf8' codec can't decode byte 0xbf in position 14: invalid start byte I do not know what the problem is. I would appreciate if you give me any help Thanks ... View more

Hi. I'm a beginner of splunk search query. I saw below search query and I did not understand what a function in sql select query. | dbxquery connection="test_db" query="select col1, col2, func_comcode(col1,'col2').... from test_table" my question is Is this function(func_comcode) user defined function?? if yes, how can I find the function definition. I think so silly question. I appreciate your answer. Thanks ... View more

I just want to create csv file automatically everyday for example, today just is created 20200417.csv tomorrow will be created 20200418.csv ... Is it possible?? ... View more