Have you also placed the props.conf on the UF? If yes, remove the props.conf on the UF. Could you also paste the contents of the props.conf here? ... View more

The HTML Panel is limited when it comes to dynamic content. You can update the contents of the html tags dynamically using variables, however, any html tags within the variable will be treated as a string and not an html tag. As a workaround, have you considered implementing the functionality of the html panel using a custom nav menu and home dashboard. Nav menu can have dynamic lists as explained here - https://dev.splunk.com/enterprise/docs/developapps/addnavsplunkapp/#Dynamic-lists This works exactly like the requirement you mentioned - I want the links to be dynamic so that as new dashboard get added then the links will be updated automatically based on some naming convention / filter logic. You can set the dashboard as landing view for the app as explained here - https://dev.splunk.com/enterprise/docs/developapps/addnavsplunkapp/#Default-search-target-and-home-page Hope this helps. ... View more

You can do direct ingestion if they are text files, not proprietary .xel files. So if you can convert them beforehand, then yes ... View more

Similar to @richgalloway 's answer However, if you need only ticket status, I would just get the latest value for that column stats latest(ticket_status) as ticket_status by ticket_num ... View more

Hopefully, I understood your question right Try this index=playground1 user=wkelsey | stats count by re_val | append [ search index="playground1" user="wkelsey" | head 1 | eval re_val=split(exp_val, " ") | mvexpand re_val] |stats count as total by re_val | where total==1 ... View more

Have you setup the SMTP server settings ? Check the mailserver section in alert_actions.conf - https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Alertactionsconf ... View more

Have you tried | eval %_Committed_Bytes_In_Use=round(%_Committed_Bytes_In_Use,2) ... View more

I hadn't noticed that you have a similar approach in yours. 🙂 ... View more

This has to be installed on your Jenkins server and not your Splunk Server. As mentioned in the link you posted, this has to be installed as a plugin on Jenkins and then configure it to send data to the Splunk server. This documentation is pretty exhaustive and I have set this up in the past per documentation and it works fine. On the splunk side, you need a HEC input setup. This plugin sends data to Splunk through HEC. Splunk has the Jenkins app which is used for visualizing the data sent by the Jenkins server. ... View more

Set the TZ parameter in the props.conf. Here's the documentation TZ = <timezone identifier> * The algorithm for determining the time zone for a particular event is as follows: * If the event has a timezone in its raw text (for example, UTC, -08:00), use that. * If TZ is set to a valid timezone string, use that. * If the event was forwarded, and the forwarder-indexer connection uses the version 6.0 and higher forwarding protocol, use the timezone provided by the forwarder. * Otherwise, use the timezone of the system that is running splunkd. * Default: empty string https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Propsconf ... View more

Hi @aamer86 This is incorrect. Default directory is just that - a default directory and not a mandatory directory. It's possible to change the base directory and have splunk running by updating the value of $SPLUNK_HOME ... View more

I see that you already are root. This is bad practice. Never use root to start the service. Next, check the permissions on the file system as suggested by @woodcock If the permissions are set up correctly, check if the disk is mounted properly. I have seen instances where the disk is set to read-only mode accidentally by the linux admin. This makes startup or usage impossible since splunk will be unable to create files. ... View more

Once you paste the query, please highlight it and press the code sample button(The button with 1s and 0's) This will ensure that the formatting for the code is maintained. ... View more

Hi @johann2017 Is the query complete? After your stats command, you will only have 2 columns - Total and src_ip. So the table statement will not have an Account_name. Neither will you have host column which is used in the rename statement. ... View more

Hi @kanamarlapudivenkatanagavinaykumar It looks like some part of your query is missing. Once you enter query, highlight it and press the code sample button (The button with 1's and 0's) This will ensure that the everything within the code sample is retained. Also, is this a different question from the original question in the post? If yes, could you please post this as a new question? This helps others who have a similar problem as you are. A new question in the comment kind of get's lost since other's wouldn't be able to view it and you miss out on inputs from other contributors in the forum 🙂 ... View more

Trying to understand the use-case. Do you want to kill the search if it's running for longer than 2 mins ? ... View more

Still doesn't make sense. Is you script hosted as a custom REST Endpoint ? ... View more

Could you provide more clarity on this? Are you trying to implement a custom REST endpoint? ... View more

Hmm. Are you getting duration values for events where start or end is null? If not, do this. | stats min(eval(if(match(lower(_raw), "security gate check"), _time, null()))) as start, max(eval(if(match(lower(_raw), "found valid consumer for identity"), _time, null()))) as end by trace | eval duration = end-start | search duration=* | stats avg(duration) as Average_Response_Time, count as total ... View more

Set an expiry for the saved search as mentioned by @DalJeanis in this post - https://answers.splunk.com/answers/666162/how-to-set-expiry-time-for-saved-scheduled-search-1.html Please mark as answer if this solves your problem. ... View more

Also, if you need only POST events, add the filter to the base search like this index= <your index> POST OR if you need everything except PATCH index=<your index> NOT PATCH ... View more

Also, if you need only POST events, add the filter to the base search like this index= <your index> POST OR if you need everything except PATCH index=<your index> NOT PATCH ... View more

That's simple | stats min(eval(if(match(lower(_raw), "security gate check"), _time, null()))) as start, max(eval(if(match(lower(_raw), "found valid consumer for identity"), _time, null()))) as end by trace | search start=* AND end=* | eval duration = end-start | stats avg(duration) as Average_Response_Time, count as total ... View more

That's very strange that you are getting just the end and not the start time. It looks like it's unable to find the pattern "Security gate check" in _raw. Could you verify that there are no special characters in the raw events? Another possibility is that it's unable to find start and end events for the same trace. Try sorting by start to see if you events with start but no end. In that case, the regex for extracting the trace might need to be modified. To convert epoch to standard time, you can use one of the following | convert ctime(<your time field>) OR | eval <time field> = strftime(<time field>, "<desired time format>") Use this to build the time format string - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Commontimeformatvariables Please upvote if this helped you. ... View more