Hi there, This is not really a Splunk question; I would start here https://argo-cd.readthedocs.io/en/stable/ cheers, MuS ... View more

Just adding the translated text here: The Splunk Enterprise upgrade procedure states that the automatic startup setting should be disabled, but why is it necessary to disable the automatic startup setting? ... View more

Hi Aedah, you are trying to upload an xlsx file which is not text. Export the file in excel as csv and upload the csv instead. cheers, MuS ... View more

Hi there, If you are downloading add-ons in your local Splunk Enterprise UI the login that is required is the login from splunk.com and if that still fails try to download it here https://splunkbase.splunk.com/    Hope this helps ... cheers, MuS ... View more

Hi there, make sure the user role has the required capabilities: edit_tokens_settings, which turns token authentication on or off edit_tokens_all, which lets you create, view, and manage tokens for any user on the instance edit_tokens_own, which lets you create, view, and manage tokens for yourself https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Security/Setupauthenticationwithtokens#Prerequisites_for_creating_and_configuring_tokens   Hope this helps ... cheers, MuS     ... View more

Hi there, Have a read here https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Knowledge/Usesummaryindexing#Get_started_with_summary_indexing    cheers, MuS ... View more

Hi there, If I recall correct the Checkpoint only supports syslog over TCP and can therefore use TLS. Splunk syslog input only supports UDP and no SSL. That said you could use a TCP input, configure TLS/SSL https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Inputsconf and see what you can get. Hope this helps ... cheers, MuS ... View more

Hi there, Please contact your Splunk sales account team for this, they are able to help you. cheers, MuS ... View more

Hi there, Can you please post an example _raww event in a code block, thanks  cheers, MuS ... View more

Hi there, Easiest way is to download, extract it and see what it includes. cheers, MuS ... View more

Hi there, Missing events from WEF/WEC can be cause by the file size, if too small they rotate away before the UF even has a change to read it .. don't ask how I know 😉  Increasing the size for the forwardedevents channel will help resolving this. Hope this helps ... cheers, MuS ... View more

HaHA, I was answering based on the provided information not trying to work around every single possible outlier 😄  ... View more

Hi there, like in most cases a simple 'stats' will do the trick. Try something like this  index=printserver OR index=printlogs | bin _time span=3s | stats values(*) AS * by _time username | table _time prnt_name username location directory file   Hope this helps ... cheers, MuS ... View more

Hi there, without sample events this can be tricky but since you provided the SPL and you join on UserAccountId I assume this field is available in both sourcetypes. If this is case, it would be as simple as   index=salesforce UserAccountId=* sourcetype="sfdc:user" OR ( sourcetype="sfdc:setupaudittrail" Action=suOrgAdminLogin ) | fields list of fields you want | stats values(*) AS * by _time UserAccountId   Hope this helps ... cheers, MuS   ... View more

Hi there, if your max value is static, you could do something like this: index=_internal sourcetype=* | timechart span=1h count by sourcetype | eval max=10000000 and this will produce 1 max line on the graph like this:   Hope this helps ... cheers, MuS ... View more

Hi there, we worked around this problem by having the same 'splunk.secret' file on all instances, this enables you to have encrypted passwords or secrets in your deployment apps. Hope this helps ... cheers, MuS ... View more

Hi there, I worked around that problem by using `tojson` before the `collect` | tojson | collect index=schnafu   Hope this helps ... cheers, MuS ... View more

ah yes, this example needs to run on its own and will create sample events. but see my other reply this needs more logic ... View more

Just noticed that will not work 🙄 will ned some loop hooping to get months and then days .... ... View more

Hi there, try this :   | makeresults | eval alert_value=1060, BatteryAge=strftime(alert_value, "%m months %d days")   this will return: but not sure you then can use it in a single value panel. Just give it a try. Hope this helps ... Cheers, MuS Update: This is based on the simple assumption every month has 4 weeks, because I'm not a mathematician nor scientist 😉 | makeresults | eval alert_value=1060, secs=alert_value*86400, months=round(secs/604800), days=round(alert_value - ((secs- (secs/604800)) / 60 /60 /24)) , alert_value = months ." months ". days ." days"   ... View more

Another example here: Solved: Re: How to use eval if there is no result from the... - Splunk Community ... View more