| tstats earliest(_time) AS _time WHERE index=bla is enough ... View more

| stats earliest(_time) AS Earliest_Time | eval Earliest_Time=strftime(Earliest_Time,"%Y-%m-%d %H:%M:%S") can be replaced by a simple  | stats earliest(_time) AS _time Splunk formats _time by default which allows you to avoid having to reformat the display of another field dedicated to time display. ... View more

Hello splunkers I am also facing the same issue and no data collection is happening due to this issue. Can anyone please guide?   ... View more

For Splunk 7 & 8 at least: To get the daily ingestion per indexer with the hostname rather than the GUID following your time range picker selection.     index=_telemetry source=*license_usage_summary.log* type="RolloverSummary" | join type=inner slave [ | rest /servicesNS/-/-/search/distributed/peers splunk_server=local | table guid host | rename guid AS slave ] | search host=*PATTERN* | timechart span=1d eval(round(latest(b) / 1024 / 1024 / 1024, 3)) AS sizeGB BY host useother=f     Replace PATTERN by your indexers hostname convention. ... View more

Yes it did. The AWS Add-on does not seem to be able to display anything even though the configuration fields should have nothing to do with the connectivity itself but apparently the code does only retrieve configuration data after a connection is acknowledged. ... View more

When you're creating services via service template from a csv file, you can define an entity_rule column in the csv file and let ITSI populates the different entity rules per service. But this would require you to configure the entity rule in the service template in such a way that the entity rules from the csv file are used during the service creation. You can refer to the following page for service template configuration: https://docs.splunk.com/Documentation/ITSI/4.3.1/Configure/CreateServicetemplate ... View more