I'm trying to export and import alerts from one search head to a new search head.  Can  transfersplunkknowledgeobjects.py be used for this? I don't know what to use for "-srcApp" so I am trying "alerts" (without the quotes) Right now I'm getting 404 errors. I do have a Bearer Token but where to put it? I looked at "Version Control for Splunk" but that is even harder to figure out how to use it. ... View more

This guy Splunks ... View more

Hello i prepared tabs dashboard but both tabs are running at same time can you help me on this . Thanks lateef     ... View more

You can use an undocumented setting in ui-prefs.conf:   [default] display.visualizations.charting.seriesColors = [0xea1b0a,0x1ea2b1,0xb00402,<ADD YOUR COLORS>]   It just didn't work as embedded report. Everywhere else - it looks fine. If you need to set the seriesColors for a specific embedded report - you can add the property in the stanza of the report in the savedsearches.conf: [myreport] display.visualizations.charting.seriesColors = [0xea1b0a,0x1ea2b1,0xb00402,<ADD YOUR COLORS>] ... View more

Store $row.SIP$ and $row.SOP$ as tokens named $rowSIP$ and $rowSOP$ and then make a 2nd drilldown with this SPL: index="__" sourcetype="__" source="___" earliest=$dateFrom.earliest$ latest=$dateFrom.latest$ DOCUMENT_ID="'$documentId$'" SERVICE_NAME="$serviceName$" SUCCESS_STATE="$successState$" | eval SERVICE_INPUT = replace(SERVICE_INPUT,"{{","") | eval SERVICE_INPUT = replace(SERVICE_INPUT,"}}","") | eval SERVICE_OUTPUT = replace(SERVICE_OUTPUT,"{{","") | eval SERVICE_OUTPUT = replace(SERVICE_OUTPUT,"}}","") | search SERVICE_INPUT = $rowSIP$ AND SERVICE_OUTPUT = $rowSOP$ | table TIME_STAMP, TIME_SPENT, SERVICE_NAME, SUCCESS_STATE, DOCUMENT_ID, SERVICE_INPUT , SERVICE_OUTPUT , TRANSACTION_TYPE, MACHINE_NAME | sendemail ...... | outputcsv .... ... View more

@felipesewaybricker Thanks for your response. Here is my source: Integration POC Dashboard for Repair <input type="dropdown" token="StripeName"> <label>Stripe</label> <choice value="DEV">DEV</choice> <default>DEV</default> </input> <input type="text" token="SRNumber" searchWhenChanged="true"> <label>SRNumber</label> <default>*</default> </input> <input type="text" token="SRLineNumber" searchWhenChanged="true"> <label>SRLineNumber</label> <default>*</default> </input> <input type="time" token="Time"> <label>Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <panel> <title>Integration POC Test</title> <table> <search> <query>index=pid sourcetype=poclog AND (Stripe = $StripeName$ OR DocumentID = $SRLineNumber$ OR TrackingID1= $SRNumber$) | rename _time as Time, DocumentID AS SRLineNumber, TrackingID1 AS SRNumber, TrackingID2 AS Depot, TrackingID3 AS HoldID| convert ctime(Time) | table Time Stripe FromSystem ToSystem TransactionNumber SRNumber SRLineNumber Transactiontype Depot HoldID InstanceID Status ErrorMessage Payload | sort -Time</query> <earliest>$Time.earliest$</earliest> <latest>$Time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">false</option> </table> </panel> I want to display all the results when the dashboard is loaded based on the Stripe selection which is happening right now. But, I also want to display the corresponding results when a user enters a value in either TrackingID1/DocumentID. Currently, we are displaying all the results initially, since I have Stripe=Dev , TrackingID1=* and DocumentID=* selected. Can you please suggest how I can get it done. Thanks in advance. ... View more

It's on Windows 10 actually, but I figured it out, I use that command after enabling permissions ... View more

Thanks for this good information. So you are right , i have made 3 new indexers, but its not faster. I am using tstats off datamodels in my search. So if i set up multiple Indexers can i add on Index clustering with 100% replication so all new indexers will have a copy of the data? Cheers Rob ... View more

I didn't understand that part either. But can you give an example o a critical criteria? ... View more

HI @Sagar0511 My name is Anam Siddique and I am the Community Content Specialist for Splunk Answers. Please accept the appropriate answer that worked for you so other members of the community can benefit from it. If none of the answers have worked for you so far please post further comments so someone can help you. Thanks ... View more

Hi @gingersoftware My name is Anam Siddique and I am the Community Content Specialist for Splunk Answers. Please accept the appropriate answer that worked for you so other members of the community can benefit from it. If none of the answers have worked for you so far please post further comments so someone can help you. Thanks ... View more

I had the same issue, in my case I solved after configure specific capabilities for this role. edit_search_scheduler I hope this will help. Rodrigo Ribeiro ... View more

In addition to @woodcock's great answer, you should avoid the intermediate HF if you don't need it for a specific purpose. UFs distribute events among indexers better than an HF. Also, the HF can actually make the indexers work harder to process events. If you eliminate the HF, be sure to set useAck=true on the UFs. ... View more

Splunk needs more tuning, upgrades and restarts than does syslog-ng so if you go directly to Splunk, without a buffer capability on the sending side, you will have far more data loss. You can update yslog-ng configurations with SIGHUP without a restart or data outage. You cannot do that with Splunk. Use syslog-ng. ... View more

$click.value$ does not work $row.$ does work ... View more

First, check if you have those capabilities, Second, use this app https://splunkbase.splunk.com/app/2878/ Third and last, use WebHook on your slack. ... View more

This is working as expected. Thanks! ... View more

If you are using UF, then you need to deploy these configurations to the Indexers or switch your UF to HF. Those kinds of props.conf configurations are executed by the first Splunk server that cooks the data which is almost always the first Heavy Forwarder or Indexer. Once deployed to the proper Splunk server(s), all Splunk instances will need to be restarted. Then, only verify on events that have been forwarded in AFTER these restarts (you can use _index_earliest=-2m ); older events will stay broken. ... View more

i know it sounds dumb, but did you restart your forwarder? It appears as active with this command? ./splunk list forward-server ... View more

nice, happy splunking ... View more

If you can suffuciently craft a search that finds only the event(s) you want to delete, you can pipe the results of that search to the delete command. Note that none of the default roles have the can_delete capability. You would need to either add this capability to a role temporarily, or create a new user/role just for this purpose. ... View more

return Error in 'eval' command: The expression is malformed. return only first row in search, but is very fast Thanks for advice ... View more