Hi @niketnilay  Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them | tstats count WHERE index=_* by index sourcetype | eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) | stats dc(sourcetype) AS st dc(index) AS idx by my_range | sort - my_range | streamstats count as sno | eval something=sno.". ".my_range | stats sum(st) AS st sum(idx) AS idx by something   Thanks and I hope this will help some one else while we wait for the fix ... cheers, MuS ... View more

Hi mpuchalski, Please read this https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data it can be configured on any Splunk instance. Just a word of caution: if you configure forwarding to a third party receiver and the receiving end goes down or is not available you will get in trouble on your Splunk instance. Hope this helps ... cheers, MuS ... View more

Hi there, since you're using REPORT it has to go on the Search Head like written, explained above: REPORT is a search time field extraction that is linked to transforms.conf cheers, MuS ... View more

I would not recommend to replace the shipped python that will result in a lot of tears 😉 Like you said, anything you build will not be upgrade proof cheers, MuS ... View more

My guess you hit this problem here https://stackoverflow.com/a/33796439 cheers, MuS ... View more

Hi phil__tanner, from what I experienced so far it's the best, easiest to put the module into the $SPLUNK_HOME/etc/apps/<appname>/bin directory and import it from there. Hope this helps ... cheers, MuS PS: Greetings up the coast 😉 ... View more

Hi elegantleaf, the error states The remote name could not be resolved: which points to DNS. cheers, MuS ... View more

Hi romanwaldecker, Late to the party, but yes this can be done using the UI. But you need to understand the differences in the various possible field extractions that can be configured in props.conf. EXTRACT is an inline search time regex field extraction that is not linked to transforms.conf REPORT is a search time field extraction that is linked to transforms.conf TRANSFORMS is a index-time/parsing field extraction since you have an EXTRACT option configured there is no transforms.conf stanza linked. An example for a REPORT option is the default field extraction of splunk_web_access which you can see using this URI: http[s]://YourSplunkServer:YourPort/en-GB/manager/launcher/data/props/extractions/splunk_web_access%20%3A%20REPORT-access?action=edit&ns=system&f_sort_key=value&f_sort_dir=asc&uri=%2FservicesNS%2Fnobody%2Fsystem%2Fdata%2Fprops%2Fextractions%2Fsplunk_web_access%2520%253A%2520REPORT-access The transform stanza name will be access-extractions which in turn could be used with the extract command like this: <your base search> | extract access-extractions | ... Hope this helps ... cheers, MuS ... View more

Hi revanthammineni, Here is some helpful inside about what are the management components in Splunk : https://docs.splunk.com/Documentation/Splunk/latest/Deploy/Manageyourdeployment#Types_of_management_components You might notice in the table that it is possible to have the DS and the Deployer component on one server BUT as @esix_splunk correctly mentioned it is not recommended and it is also stated in the docs just above the table: In some low-use situations, you might be able to combine more than two management components on a single instance, although it is not generally recommended that you do so. If you intend to do so, monitor the performance impacts closely to ensure that you are not overloading the instance. Hope this helps ... cheers, MuS ... View more

Okay, give this a try: | makeresults count=1000 | eval _time=now() - random() | eval mytime=strftime(_time, "%Y/%m/%d") | table mytime | rex field=mytime "(?<Year>\d+)/(?<Month>\d+)/(?<Day>\d+)" | stats count as Count by Year,Month,Day | sort Year,Month,Day | eventstats last(Month) as Current_Month last(Year) as Current_Year | where Month!=CurrentMonth OR Year!=Current_Year | stats avg(Count) as DayAveravge values(Month) as Months by Day The regex did not really work, but I have no idea if the current result is what you expect ¯\_(ツ)_/¯ cheers, MuS ... View more

Hi henderz, it says your regex is not correct and the reason are the " inside the regex: | rex field=mytime "("?<Year>\d+)/(?<Month\d+)/(?<Day>\d+)")" use this instead: | rex field=mytime "(\"?<Year>\d+)/(?<Month\d+)/(?<Day>\d+)\")" cheers, MuS ... View more

In regards of 42 ... https://www.independent.co.uk/life-style/history/42-the-answer-to-life-the-universe-and-everything-2205734.html And you have some search errors there; on ES that could indicate a problem - just saying ... ... View more

Hi sarahnazzar, Take a look at this answer https://answers.splunk.com/answers/151846/how-to-convert-hex-to-ascii-in-splunk.html#comment-220057 which provides a nice way to convert HEX to ASCII. Hope this helps ... cheers, MuS PS: If it does not, please provide sample events and expected result so the community is able to help you 😉 ... View more

This ^^^ or permission issues or ... anything else that could cause an error in ES. Did you check all the internal logs of Splunk to see if you get errors when opening the 'Incident Review'? Any other error in any other log files? As @DavidHourani has asked, did you recently upgraded and did you restart Splunk after that? Have to tried to _bump the Splunk instance? I could add so many things to this list, but without more details we will never be able to help. cheers, MuS PS: It looks like you did not get my previous joke about 42 😉 ... View more

Hi henderz, please have a read about the timewrap command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap#Examples This SPL command provides options to achieve your use case. Hope this helps ... cheers, MuS ... View more

There are 42 matching events ... I reckon this ES has found the answer to everything 😉 cheers, MuS ... View more