Hi All, At Monitoring Console (MC) --> Search Activity : Instance, there is "top 20 Memory-consuming searches", which is searching from index=_introspection. As I run the search, it is not recognizing saved search (scheduled search).  Why doesn't the search starting index=_introspection recognize saved search (scheduled search)? It seems not it returns results from all searches. How do I get to know memory consumption of all searches including saved search(scheduled search)? Do I have to join index=_introspection and index=_audit?       ... View more

Hi,  There is the description for INDEXED_VALUE in fields.conf INDEXED_VALUE = [true|false|<sed-cmd>|<simple-substitution-string>] * Set this to true if the value is in the raw text of the event. * Set this to false if the value is not in the raw text of the event. * Setting this to true expands any search for key=value into a search of value AND key=value (since value is indexed). * NOTE: You only need to set indexed_value if indexed = false. INDEXED_VALUE is used when indexed = false according to the description. Then, when is the option INDEXED_VALUE used? Which circumstances require this option? Is there a case where only value is indexed and key(field) is not indexed? The description makes me confused.. Hope anyone help me out. Thanks a lot. ... View more

Hi All, I have two saved search ; report1, which is shared in app and report3, which is private. Owner of two saved search is admin both. As I see the scheduler.log, seavedsearch_id for report1 is "nobody; search;report_1 and seavedsearch_id for report3 is "admin; search;report_3". My question is.. 1. If I share the saved search in app, the owner is still admin but the saved search id is changed to "nobody;.....". Does it mean the search is running as nobody when I share the search in app? 2. When I see these saved search activity on DMC -> Search -> Scheduler Activity: Instance, it dose not show  the cron schedule info for report_1. It leads to misinformation for search concurrency on DMC -> Search -> Search Activity: Instance.  --> DMC dose not recognize report_1 as scheduled search. It leads to misinformation below --> 1/4 should be 2/4. Could you please explain why it happens? I think DMC has to recognize two scheduled searched. It seems that if the saved search is shared, DMC don't track the search. Am I correct?  Is it normal behavior? I would appreciate if you give me any thought about it. Thanks. ... View more

Hi All, We runs only one splunk instance within our network and plans to open IP ranges and ports in order to collect Teams log. I wonder if I have to open all addresses and ports from here: https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#skype-for-business-online-and-microsoft-teams Do we have to open all of the IPs and ports? Isn't it risky from a security point of view?   Any comment would be appreciated.   ... View more

Hi All,   Is it possible to send alert to users who have specific role? I am asking if it is possible to send alert based on roles. Saying this is the alert result. In the result, there is role information(column3) column1 column2 column3  AA             BB              users           ===> I would like to send this result to only users who have user role AAA          BBB           admin          ===> I would like to send this result to only users who have admin role   Is it possible? When a user who has power role logs in the Splunk web, the user should not see the alert. Your help would be appreciated.   ... View more

Hi All, My question is the same as the title. How am I able to index Json array into metric index? I would appreciate if anyone would help me out. Thanks!! Json sample: { "MachineName": "East1", "Temperature": [ 10, 12, 13, 10, 11, 12, 14, 9, 12, 16,................18, 11, 13, 11, 10, 8] } { "MachineName": "East2", "Temperature": [ 10, 12, 14, 9, 12, 16, 14, 9, 12, 16,................18, 10, 12, 13, 10, 11,] } { "MachineName": "East1", "Temperature": [ 10, 12, 10, 12, 13, 10,  14, 9, 12, 16,................ 14, 9, 12, 16, 10, 8] } { "MachineName": "East2", "Temperature": [ 14, 9, 12, 16, 11, 12, 14, 9, 12, 16,................18, 11, 13, 11, 10, 8] } ... View more

Hi All, I have a question about metric rollup. https://docs.splunk.com/Documentation/Splunk/latest/Metrics/MRollupsOverview As stated by the document, metric rollup is for saving storage. Saying there are source metric index(A) and target metric index(B). Then, how is it for saving storage? Origin data indexed in index(B) is rolled up into index(B), which means taking more storage. My question is this: do I have to delete source index(A) periodically? How to handle source index in metic rollup environment? ... View more

Hi, I need to collect Azure container log into splunk. I will utilize azure monitor app for splunk. It is pulling log from event hub as I know. Then, Azure container has to send container log to event hub. Is it possible?   What is the best intention method to collect data from Azure container into splunk? ... View more

Hi All, I am trying to test DLTK. As I run a search for sending to container, it shows errors: unable to read JSON response from http://localhost:32775/fit. Either you have no MLTK Container running or you probably face a network or connection issue. Returned with exception (Expecting value: line 1 column 1 (char 0)) Docker container is running and I implemented the sample code on jupyter notebook. What is wrong with this? The SPL I run is this:  | inputlookup server_power.csv | fit MLTKContainer mode=stage algo=linear_regressor epochs=10 batch_size=32 ac_power from total* into app:server_power_regression Could anyone know about it?     ... View more

Hi, Does anyone know how to change tcp input queue size? I know other queues such as indexQ, parsingQ, aggQ, are changeable at servers.conf, and in the case of output queue it is able to be changed at outputs.conf. But I didn't find out any information about tpc input queue setting.  I would appreciate if anyone let me know about it. Thanks in advance.   ... View more