Alerts are based on searches. Searches do _not_ have to be based on indexes. You could event do a repeated daily search to detect the DST change. But the question is why use Splunk for it in the first place. ... View more

I didn't copy all the files and directories mentioned by you and also didn't put the old CM in maintenance mode but did change the URL and FDQN for all the instances. Probably the problem arose from the fact that the production instance has a lot of moving data and not going into maintenance mode caused the problems. Even, the test site had moving data but did not have a lot of data like production. What was surprising is that there were no logs that showcase any exact reason of error. However, I used the techniques mentioned by you and was able to migrate CM to new hardware. Thanks to you @isoutamo      ... View more

OK. Please describe your ingestion process. Where do the events come from? How are they received/pulled? On which component? Where does the event stream go to from there? What components are involved and in what order? Where are you putting your settings? ... View more

I don't think I understand what you're trying to do. $Beta status:result._statusNumber$ is a token set by your search, "Beta status", and therefore has no default value. The screenshot you've shown is for setting tokens when users click on a visualisation. The two things are not related, really, other than how they are used in source code.  What issue are you trying to solve, exactly? If the token isn't working, have you made sure you've checked the "Access search results or metadata" box in the data source config?  ... View more

If I recall right you could put html files into appserver directory? See https://community.splunk.com/t5/All-Apps-and-Add-ons/Creating-an-APP-and-setting-a-custom-HTML-Webpag/td-p/398100 ... View more

This explains things more easily than those docs if you haven’t earlier experience about TLS https://conf.splunk.com/files/2023/slides/SEC1936B.pdf ... View more

By default the Splunk server receiving HEC is set to only log INFO and above.  If you have a very limited number of receiving end points you can temporarily increase to DEBUG and above for logging.  If you have a small number of HF's or IDX tier then this is feasible, if you have a large IDX tier then it's not so easy. The debug will be specifically helpful in identifying the source of bad connection attempts.  I don't recall the token being visible and since any invalid token has no categorization with internal input configurations some real advanced answers are unlikely.  I also don't recall any capability to receive and process data without a valid token as it would create data poisoning issues along with license capacity issues to do so. UPDATE Sorry, it just dawned on me this was for OTEL not Splunk receiving.  ... View more

I'm not 100% sure what you are looking for, some of your sample search is hidden behind macros making it harder for me to decipher.  Can you provide the raw search and sampling of expected outcomes? ... View more

Thank you. It's worked for me. ... View more

Thank you !!! it worked ! ... View more

https://docs.splunk.com/Documentation/Splunk/9.4.0/Installation/Systemrequirements (Dec 3rd 2024) showing support of amznlx2023 for x86 (but not for ARM). But SPLUNK cloud latest rel is 9.3.2408 (checked on Dec16,2024) ... View more

Actually TLS mutual authentication is done by the openssl library and can be configured on an intermediate UF as well (did it myself several times on s2s inputs). It's just that http input isn't officially supported on UF (any documentation about HEC mentions only Splunk Enterprise or Cloud). So in case anything goes sideways first thing you'll hear from support is "use a HF instead of UF". ... View more

Thank you for the suggestion.  I could not test it, as an alternative approach has been adopted in the meantime. ... View more

That's the best method I know of.  There is an app for Apple devices but it's just desktop sized viz so might as well stick with what you have now. ... View more

Of course, checking when there are "missing" events is one of possible ways of checking uptime. But that's a completely different problem. ... View more

I agree.  My last environment I managed had UF versions ranging from high 6.x to low 9.1.x.  Any upgrade readiness scans would lite up like a Christmas tree looking at the DS folder. ... View more

Thank you for your thoughts, colleagues. I will check the idea of @dural_yyz that mentioned the absence of an EOF marker. @PickleRick , talking about permission, I'm pretty sure that this is not the case because about a month ago I found out that new Splunk UFs started to use "USE_LOCAL_SYSTEM = 0" by default during silent install. Because of it I was observing something like this on the affected UF instances: 10-27-2024 21:50:16.756 +0300 ERROR TailReader [3644 tailreader0] - Unable to remove sinkhole file: path=E:\path\file.xml, errno=Access is denied.   ... View more

Note @PickleRick response though about relationship between MV values in different fields. You can easily find yourself in a world of MV pain if you're not careful. You need to KNOW your data well to start correlating MV fields using an index/offset. If there is a null() or empty value in any of the MV fields then the index offset will be out of alignment.  ... View more

The answer will depend greatly on your particular use case. If it's a simple count, @dural_yyz 's answer is what you're looking for. But if you're trying to calculate some more complicated stats it might be more troublesome to do and it might turn out that it's easier to just have two separate searches (possibly appended within one aggregating search). The approach I'd probably use would be to find unique values, mark them and use eval-based stats to calculate "deduped" stats. ... View more

The cluster/manager/info endpoint should have what you want.  See https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTcluster#cluster.2Fmanager.2Finfo ... View more

Already did, unhelpful support - they literally told me to try and change wifi network. haven't had this kind of support for years. ... View more

In my experience XML dashboards wont let you do scrolling for a single viz.  I just played around with Dashboard Studio and I can force a space between the lines but it just squeezes the lines.  There is no scrolling on the viz no matter the size of the panel.  I don't believe the behavior you want is possible. ... View more

Also you should define what is your synonym for “common hours”? ... View more

In props.conf, when you are using sourcetype as stanza name, use just the name of sourcetype instead add prefix sourcetype:: ... View more

Sorry about the delay. Unfortunately this does not seem to be the problem I have changed the local.meta to # simquery command [commands/simquery] access = read : [ * ], write : [ admin ] And restartet - that why it took so long - but I still get the same error ... View more