Hello, I'm having an issue when trying to filter events based on accented characters. For instance if I look at the ingested events, index=my_index sourcetype=my_source , I will be able to see the events that have the field value I'm looking for: ... asset_name ... ... D. João ... If I try to filter the events at search time index=my_index sourcetype=my_source asset_name="D. João" , the "No results found." message is displayed, the same applies if I select the desired field value from the field's list on the left. How can I get this to work? I've looked for similar questions here on the Splunk Answers forum but it mainly points for the sourcetype encoding, which I think might not be the issue, since the events seem to be properly encoded. Thanks in advance! ... View more

Hello, I'm trying to find the best way to do the following: Source A: id_field1 id_field2 fielda1 fielda2 Source B: id_field1 id_field2 fieldb1 Source C: id_field1 fieldc1 I want to retrieve fieldb1 and fieldc1 from source B and C respectively and still be able to search fields from source A. Fieldb1 and fieldc1 can store distinct values for the same id_field. Example: _time id_field1 id_field2 fielda1 fielda2 fieldb1 fieldc1 xx-yy-zzzz 111 444 FA1 FA2 AAA CCC xx-yy-zzzz 111 444 FA1 FA2 BBB CCC xx-yy-zzzz 111 444 FA1 FA2 AAA ZZZ I tried several approaches: - Used eventstats to add both fieldb1 and fieldc1 to events, which is a slow method. - Used the trick eval id__{source}=id_field1 | stats values(id__*) as id__* (...) by id_field1 | where id__sourcea=id__sourceb (...) so far this seems to be the best approach but by applying the values to fieldb1 and fieldc1 I'll sometimes have a multivalue field which will lead to use the mvexpand command and make the query even slower. Another issue is that applying the values() will sort the multivalue field alphabetically and I'll loose track of the connection between id_field2 and fieldb1. Using an automatic lookup won't fit due to the huge number of distinct id's. I'm also looking at the append function but due to its 50k events limitation I think it won't work. Could you provide some guidance on how to do this? Thanks in advance. ... View more

Hello, I am expanding my environment from an Indexer Cluster composed by one Indexer and two Search Heads, to an Indexer Cluster with five Search Heads. Each Search Head should have a set of specific apps, that we have developed, and one of those apps has minor changes to its content and its name based on the Search Head they are being deployed at. Sometimes, when I run a search, within the previously mentioned app context, I'm getting the following error: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. Inspecting the log it contains the following ERROR: ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: <app_name> The app exists, since I'm running the search in it. I do not have a Deployment Server so the apps are being deployed manually on the Search Heads. I'm having trouble finding the root cause of the issue since sometimes the Searches work and some times they do not,I've tried: Deploying the app via the webclient; Deploying the app via the console; Playing with the app permissions; Does anyone have some advice on how to fix this? I've already looked for similar questions on the forum and so far none of the accepted answers helped me. Thanks in advance! ... View more

Hello, I'm experiencing this error when I perform some searches on my index, idx= Could not read event: cd=(n/a). Results may be incomplete ! (logging only the first such error; enable DEBUG to see the rest) I saw this issue was fixed on 7.0.1 but my instances are on 6.4.8, is there a workaround for this or a way to fix it? I tried these commands: splunk fsck scan --all-buckets-all-indexes splunk fsck repair --all-buckets-all-indexes But it with no success. Thanks in advance ... View more

Hey, I'm setting up an Indexer Cluster and a Search Head for the first time and I'm facing an issue on the Search Head. I can search the indexes content with the Search Head, but on the Settings>Indexes page I do not have information regarding the Indexes. I'm not exactly sure how to link the Search Head to the indexes.conf of the peers. If I upload the same indexes.conf to the Search Head they do show up, but as if they were on the Search Head, which then retrieves no useful information. How can I troubleshoot this? Thanks in advance! ... View more