i was unable to login with my credentials can u pls help me ... View more

(under the link) Thanks a lot. Uninstall an app or add-on To remove an installed app from a standalone Splunk platform installation: (Optional) Remove the app or add-on's indexed data. Typically, the Splunk platform does not access indexed data from a deleted app or add-on. However, you can use the Splunk CLI clean command to remove indexed data from an app before deleting the app. See Remove data from indexes with the CLI command. Delete the app and its directory. The app and its directory are typically located in $SPLUNK_HOME/etc/apps/<appname>. You can run the following command in the CLI: ./splunk remove app [appname] -auth <username>:<password> You may need to remove user-specific directories created for your app or add-on by deleting any files found here: $SPLUNK_HOME/etc/users/*/<appname> Restart the Splunk platform. ... View more

@sacumen see if the following rest query gives what you are looking for   | rest /servicesNS/-/-/saved/searches | search title=* | table title cron_schedule eai:acl.owner actions dispatch.earliest_time dispatch.latest_time search ... View more

Thanks for raising this query. I am having same issue, there is no pre-populated data in the sandbox version.  ... View more

Thank you for the replu Soutamo. I have explored this option and I think this works good if every alert that is configured aligns to this method. Currently there are many alerts that are running and they are set up with different alert actions and hence this method will not help for the scheduled alerts. I got response from splunk slack group and the response is as below: jeffland 14 hours ago When an alert runs, it lives for as long as its expiry setting allows it to. This data is pretty much a regular search job, so nothing you can "search" for with SPL as there is nothing that has been indexed (it lives on the disk of the search head running the search). Additionally, if you configured alert actions, those run if the criteria were met. If you sent out an email, it will be in the recipients mail box. If you indexed something, you'll find it where it was configured through the alert action configuration.   When an alert runs, it lives for as long as its expiry setting allows it to. This data is pretty much a regular search job, so nothing you can "search" for with SPL as there is nothing that has been indexed (it lives on the disk of the search head running the search). Additionally, if you configured alert actions, those run if the criteria were met. If you sent out an email, it will be in the recipients mail box. If you indexed something, you'll find it where it was configured through the alert action configuration. ... View more

Thank you for the git link reference to the app,  create_thehive_alert.It worked. I tried using app, "TA_the hive_ce" but this did not help to send alerts from splunk to the hive.   ... View more

Hi, I thought I replied here but somehow I am unable to view my reply. The above where condition is not working when I have 10-12 index to use inside IN(A,B,C.....K,L) Issue 1: It says that where condition is missing closure with  )" when I use more that 2 index values Issue 2: It returns the events but it won't display the events ( I tried verbose and fast modes) but I can't see the events ( I do encounter this situation even when no syntax errors/ no error message) not sure why this situation happens, appreciate response for this condition as well. Please advise how how I can use filter the data model to fit only to my index values     ... View more