Sorry but no! This post is missing all basic details, informations just to be able to actually recapture what problem you might have encountered. Without further details, informations this can not be solved. Please provide more details like real world events for both indexes and and what you want to achieve. MuS ... View more

Hi  bmorgenthaler  , you can use `streamstats` to calculate the time difference and filter on that like this: your base search here | streamstats current=f last(_time) AS l_time last(EventType) AS l_EventType by EventType | eval diff = _time - l_time | where diff < 60 AND l_EventType=="AGENT_DISCONNECT" AND EventType=="AGENT_RECONNECT" This might needs tuning but will give you a starting point. Hope this helps ... cheers, MuS  ... View more

Hi there, Take a look at this answer https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477 it provides examples how it can be done. Basically get a common field over all events and use stats to do the final calculations. Hope this helps ... cheers, MuS ... View more

Hi there, nowadays this can be configured in the Splunk UI under `Settings - User Interface - Time Ranges` cheers, MuS ... View more

Hi @niketnilay  Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them | tstats count WHERE index=_* by index sourcetype | eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) | stats dc(sourcetype) AS st dc(index) AS idx by my_range | sort - my_range | streamstats count as sno | eval something=sno.". ".my_range | stats sum(st) AS st sum(idx) AS idx by something   Thanks and I hope this will help some one else while we wait for the fix ... cheers, MuS ... View more

Hi mpuchalski, Please read this https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data it can be configured on any Splunk instance. Just a word of caution: if you configure forwarding to a third party receiver and the receiving end goes down or is not available you will get in trouble on your Splunk instance. Hope this helps ... cheers, MuS ... View more

Hi there, since you're using REPORT it has to go on the Search Head like written, explained above: REPORT is a search time field extraction that is linked to transforms.conf cheers, MuS ... View more

I would not recommend to replace the shipped python that will result in a lot of tears 😉 Like you said, anything you build will not be upgrade proof cheers, MuS ... View more

My guess you hit this problem here https://stackoverflow.com/a/33796439 cheers, MuS ... View more

Hi phil__tanner, from what I experienced so far it's the best, easiest to put the module into the $SPLUNK_HOME/etc/apps/<appname>/bin directory and import it from there. Hope this helps ... cheers, MuS PS: Greetings up the coast 😉 ... View more

Hi elegantleaf, the error states The remote name could not be resolved: which points to DNS. cheers, MuS ... View more

Hi romanwaldecker, Late to the party, but yes this can be done using the UI. But you need to understand the differences in the various possible field extractions that can be configured in props.conf. EXTRACT is an inline search time regex field extraction that is not linked to transforms.conf REPORT is a search time field extraction that is linked to transforms.conf TRANSFORMS is a index-time/parsing field extraction since you have an EXTRACT option configured there is no transforms.conf stanza linked. An example for a REPORT option is the default field extraction of splunk_web_access which you can see using this URI: http[s]://YourSplunkServer:YourPort/en-GB/manager/launcher/data/props/extractions/splunk_web_access%20%3A%20REPORT-access?action=edit&ns=system&f_sort_key=value&f_sort_dir=asc&uri=%2FservicesNS%2Fnobody%2Fsystem%2Fdata%2Fprops%2Fextractions%2Fsplunk_web_access%2520%253A%2520REPORT-access The transform stanza name will be access-extractions which in turn could be used with the extract command like this: <your base search> | extract access-extractions | ... Hope this helps ... cheers, MuS ... View more

Hi revanthammineni, Here is some helpful inside about what are the management components in Splunk : https://docs.splunk.com/Documentation/Splunk/latest/Deploy/Manageyourdeployment#Types_of_management_components You might notice in the table that it is possible to have the DS and the Deployer component on one server BUT as @esix_splunk correctly mentioned it is not recommended and it is also stated in the docs just above the table: In some low-use situations, you might be able to combine more than two management components on a single instance, although it is not generally recommended that you do so. If you intend to do so, monitor the performance impacts closely to ensure that you are not overloading the instance. Hope this helps ... cheers, MuS ... View more