while I use this case to resolve the hostname,it returned host as "$1"  ,why? ... View more

Instead of adjusting the props.conf directly, it is possible to do this with the GUI with settings-> sourcetype -> edit sourcetype -> Advanced.  ... View more

Perfect!  Thanks for your help. ... View more

Hi, While it is true that there is no direct support for 2FA (Duo) in Splunk Cloud anymore (it was removed after 6.6 I believe), the way to still achieve 2FA is to do it at the SAML/IDP layer. As long as your IDP supports 2FA and the 2FA bits happen outside of Splunk, go for it. ... View more

Try this index=pan app=* | stats count values(app) as app by src | where NOT (app="ssl")   ... View more

Let me ask a slightly different question. In general, is it going to be faster using a string search compared to a field search? ... View more

Dude, I've been ignoring this issue for years. You chased it down. Here- take my karma!! ... View more

Take a look at my solution here, you may be having the same issue: https://answers.splunk.com/answers/609211/how-do-i-change-the-rest-api-execution-timeout.html ... View more

rich7177, thanks so much for your help. I was able to get the query working by moving my eval commands to go after my stats. eventtype=A | timechart count span=1d | append [search eventtype=B | transaction host maxspan=3m | timechart count as B_Count span=1d] | append [search eventtype=C | timechart count as C_Count span=1d] | stats first() as by _time | eval B_Rate=(B_Count/count)100 | fieldformat B_Rate=tostring(round(B_Rate,2))+"%" | eval C_Rate=(C_Count/count)100 | fieldformat C_Rate=tostring(round(C_Rate,2))+"%" ... View more

Please mark this as answered, if it worked for you - thx ... View more

Well, old question but maybe worth to comment: Remember to check you have a rule in inputs.conf somewhere. Check this with splunk btool inputs list --debug | less and search for a stanza where there is NO "disable = 1" entry! HTH, Holger ... View more

Ah, I see now that you're doing a stats early in your search. After that stats command, the _time field will no longer be available. I don't know enough about your data to say how you would switch away from stats , but generally if you want to run stats against your events but without having it consume all fields, leaving only the aggregated results, switch to using eventstats instead. It will write its results as field values in the original events instead. ... View more

beware that the type=outer the join command is actually a left outer join, meaning it will still discard null results from one side. For this reason I recommend looking into the append command here and not using join at all. ... View more

Thank you. Replacing 'field=host' to 'in host' fixed the issue. ... View more