About LordLeet

woodcock · ‎10-11-2018

If you only have one Indexer then you probably do not have a Cluster Master so forget about Maintenance Mode (that is a CM-only thing). There is never any reason to stop a forwarder; it should queue just fine if the indexer disappears. The only thing stopping it will do is stop it from complaining about no indexers in its _inernal log.

LordLeet · ‎08-22-2018

Hello CarsonZa, That works, though using regex would not be the final solution I would like to implement since the majority of the users that perform searches do not possess the required knowledge. I might have to assess the encoding to prevent this from happening. Thanks

deepashri_123 · ‎04-17-2018

Hey LordLeet, Are you trying something like this: source=sourceA OR source=sourceB OR source=sourceC | stats values(fielda1) AS fielda1 values(fielda2) AS fielda2 values(fieldb1) AS fieldb1 values(fieldc1) AS fieldc1 values(id_field1) AS id_field1 values(id_field2) AS id_field1 by _time Let me know if this helps!!

joshuamcqueen · ‎03-16-2018

Solution: Rename the app and deploy to search heads.

LordLeet · ‎01-24-2018

After more tests and playing around with the query I've noticed that if I remove the earliest and latest parameters and select the time range I wanted using the time picker, it works as intended. This is fine if I'm retrieving data from a single index or if I am retrieving data within the same interval. I'm wondering how could it be done if I wanted an entire week data from one of the sources and only data from the previous day on another, I couldn't set this up only using the time picker.

LordLeet · ‎03-07-2018

Hey dd_msearles, The issue solved itself since the events causing the issue were removed due to my retention time period. Sorry for not being of great help. Regards

LordLeet · ‎12-27-2017

Thanks, Did the required changes and managed to replicate the index content on the Search Peer with no issues. Cleaned the events on the Search Head and can still access them from the Search Peer so it seems to be working as intended. Regards

woodcock · ‎01-18-2019

Create a new question, let's not hijack this one.

LordLeet · ‎03-02-2018

Hello jsuryaprakash, I'm facing a similar issue, did you manage to fix it? Regards

LordLeet · ‎11-29-2016

Thanks sundareshr, I managed to do what I wanted with the map function. Best Regards.

Posts	23
Solutions	1
Karma Given	5
Karma Received	4
Member Since	‎11-28-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

In a Splunk cluster on Cloud, what are some best p...

Searching strings with accented characters

Merge fields from distinct sources on event

exit_code=255 ERROR dispatchRunner

Manipulate _time value on collect

Could not read event: cd=(n/a). Results may be inc...

Store Search Head collect on Search Peer

Indexer Cluster & Search Head Indexes.conf

Is it possible to iterate over a scheduled search?

Re: In a Splunk cluster on Cloud, what are some be...

Re: Searching strings with accented characters

Re: Merge fields from distinct sources on event

Re: exit_code=255 ERROR dispatchRunner

Re: Manipulate _time value on collect

Re: Could not read event: cd=(n/a). Results may be...

Re: Store Search Head collect on Search Peer

Re: Indexer Cluster & Search Head Indexes.conf

Re: Hello every one, while I am searching on splun...

Re: Is it possible to iterate over a scheduled sea...

Join the Conversation