Hi @tsheets13, good for you, see next time! Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated by all the Contributors 😉 ... View more

you can edit your question 🙂 ... View more

Perfect! Thank you ... View more

you're welcome. ... View more

That's exactly what I needed. Thanks ... View more

I have a similar problem, except I've altered an existing Splunk App. I would rather not outright alter the runpowershell.cmd. Is there a way I can do it in a bin/local manner? ... View more

@tsheets13 I have converted your comment to answer. Please accept the same to mark this question as answered and assist others facing similar issue. ... View more

Resolved. Error in hosts file. ... View more

If you install the indexes.conf file from you indexer(s) on your search head(s) then the SH will know what all of the indexes are. ... View more

Check out David Paper's excellent dashboard that analyzes searches: https://splunk-usergroups.slack.com/files/U04JY7N3G/FFGJD40AJ/extended_search_reporting.xml https://gist.github.com/automine/06cdf246416223dacfa4edd895d0b7de ... View more

I misspoke (mistyped). We added 2 indexers. ... View more

Hi tsheets13, Yes, the splunk command sends output to stdout. You can try this for the status option: splunk@crux:~$ /opt/splunk/bin/splunk status 1> /tmp/foo splunk@crux:~$ cat !$ cat /tmp/foo splunkd is running (PID: 2431). splunk helpers are running (PIDs: 2432 2621 4649 4682). splunk@crux:~$ But i found that the restart option works best when using | tee instead: splunk@crux:/opt/splunk/var/log/splunk$ /opt/splunk/bin/splunk restart | tee /tmp/foo Stopping splunkd... Shutting down. Please wait, as this may take a few minutes. ..................................... Stopping splunk helpers... Done. Splunk> Like an F-18, bro. All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Waiting for web server at https://127.0.0.1:8000 to be available........... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at https://crux:8000 and the output looks like this: splunk@crux:/opt/splunk/var/log/splunk$ cat !$ cat /tmp/foo Stopping splunkd... Shutting down. Please wait, as this may take a few minutes. ..................................... Stopping splunk helpers... Done. Splunk> Like an F-18, bro. All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Waiting for web server at https://127.0.0.1:8000 to be available........... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at https://crux:8000 splunk@crux:/opt/splunk/var/log/splunk$ Hope this helps ... cheers, MuS ... View more

host is the hostname of the search head splunk_server is the DNS name of the search head ... View more

@tsheets13 If you found a solution, kindly mark the question as answered so other will know what worked for you, also up-vote any helpful comments ... View more

Early in the search we do a lookup lookup TimeServersV2.csv server as server OUTPUT "type" as type APP as APP type is used as part of the search succesfully, but if I add either APP or type to the untable command, it complains "The argument 'type' is invalid. ... View more

Make sure you are using the Master Node for Index Clusters and the Deployer for Search Head Clusters. The need for a Splunk restart on SH and Indexers is actually determined by the app getting deployed. Splunk UI should provide a message to notify if a restart is required. ... View more

tsheets13 - thank you, that answers my question. I had not stumbled on that section yet! Post-migration bucket behavior After migration, all buckets created before migration continue to adhere to their single-site replication and search factor policies, by default. You can alter this behavior so that pre-migration buckets adhere instead to the multisite policies, by changing the constrain_singlesite_buckets setting on the master's server.conf to "false". ... View more

Updated my answer. I agree with your comments. ... View more

You could start with index=_internal sourcetype="splunk_web_access" sideview_utils ... View more

If the input is using INDEXED_EXTRACTIONS then the field creation is happening on the UF, otherwise it is not. ... View more

I can't reproduce the issue. I follow the link, I log in, and I can see the downloads available. When you follow the link and log in, you get only a partial page? What browser/OS/region are you in? (me: Chrome/MacOS/USA) ... View more