HI, This could be possible if there are some space around your field value. so to check this you can check length of your field value using below search- ...|eval length=len(myfield) ... View more

@dstuder Not sure on search head cluster but I would prefer to use db-connect on heavy forwarder where there won't be any password sync issue. If you can move db-connect app to Heavy forwarder would solve this issue ... View more

In manual detention, it will not consume new data but available for data rebalance. I would suggest to use below command for decommisioning- splunk offline --enforce-counts ... View more

@gchauhan , haw a 4.2+ archive *nix users Here is an example of safely restoring a 4.2+ archive bucket to thawed: 1. Copy your archive bucket into the thawed directory: cp -r db_1181756465_1162600547_1001 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb Note: The bucket id cannot conflict with any other bucket in the index. This example assumes that the bucket id '1001' is unique for the index. If it isn't, choose some other, non-conflicting bucket ID. 2. Execute the splunk rebuild command on the archive bucket to rebuild the indexes and associated files: splunk rebuild $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/db_1181756465_1162600547_1001 3. Restart the indexer: splunk restart   Refer- https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Restorearchiveddata ... View more

Hi @Ashwini008  Refer @worshamn answer from https://community.splunk.com/t5/Dashboards-Visualizations/how-to-refresh-the-panel-not-entire-dashboard/m-p/172360  Let me know how it goes. ---------------------------------------------------------------------------- If it helps an upvote will be appreciated. ... View more

Hi @aditsss  Use below cron to run job at every day at 6 am 0 6 * * *   https://crontab.guru/#0_6_*_*_*  -------------------------------------------------------------------------------------------- If this reply helps you, an upvote will be appreciated ... View more

@andres91302  Please try opening downloaded csv file in Microsoft excel to see results in tabular format. If this reply helps an upvote will be appreciated! ... View more

@ismail_salma198  have you made below configuration as mentioned https://splunkbase.splunk.com/app/4070/#/details  -------------- Configuration ------------ Just update ip_info_setup.conf in $SPLUNK_HOME/etc/apps/ip_info/local/ [api_configuration] api_url = https://ipinfo.io/ token = <your token here> and restart Splunk ... View more

@mah While Creating summary index add below eval condition to get timestamp value from timestamp fieldname- ...|eval _time=timestamp   ... View more

@christinaef07 you can use below regex to extract whole string in message . below regex will extract everything after `message=` in message field. ...|rex "message(?<message>.*)"   ... View more

@rrovers  Please accept it as solution to help future readers as well. ... View more

@avneet26 you can use substr command- |eval errorOccuredOn=substr(errorOccuredOn,1,10) ... View more

@marco_massari11 if you want extract multiple fields then try below- Updated-   Site (?<field1>\w+)[^\\\\]+\\\\(?<field2>\w+)   It will extract in field1 and field2. ------- let me know if it helps!  ... View more

@SS1  Does `Enabled` field is getting extracted already? if not then add `Enabled` field extraction logic before stats command. ... View more

@SS1  you may want to use values(<fieldname>) as <newfieldname>  like below- index="appv" (sourcetype="AppV-User" *PUT /package*) OR (sourcetype=sql_appv_packageversion) | rex "\/packages\/\w+\/(?<Id>\w+)\s+-\s+\d+\s+(?<User>[^ ]+)" | stats dc(sourcetype) AS dc_sourcetype values(Name) AS Name values(User) AS User values(Enabled) as Enabled BY Id | where dc_sourcetype=2 ... View more

@marco_massari11  Try below | eval site=case(substr(Device,1,7)=="mysite1",substr(Device, -4),1=1,substr(Device,1,7) )   ... View more

key value pair will get automatically extracted by splunk. Could you please provide any details what exactly you want to match since from your example whatever is present after `=` sign will get store in `aaa` field. see below url to match everything you mentioned- https://regex101.com/r/X5Yzo7/1 --- If this reply helps you, an upvote would be appreciated. ... View more

@georgear7  Try below search which will search Package containing "bw" and status as "successful". |search Package="*bw*" AND status="Successful" Try below search with dummy data- |makeresults|eval Package="a.bw.int-7", status="Successful" |append[|makeresults|eval Package="a.bw.int-7" , status="No_File"] |append[|makeresults|eval Package="app.int-4" , status="Successful"] |search Package="*bw*" AND status="Successful" If it helps upvote will be appreciated!   ... View more