This Search can be used to check data correctly during search time: SPL:- index= <index_name> source=<source> host="<host>" sourcetype="XmlWinEventLog" | rex mode=sed field=_raw "s/&lt;/</g" | rex mode=sed field=_raw "s/&gt;/>/g" ... View more

It was worked to me! Thanks a lot! 😄 ... View more

Try | tstats count where index=sm ... View more

Hello, To check version of all apps and add-ons installed on Splunk via CLI? ./splunk list app && ./splunk list add-ons | sort AND try this one in GUI in Splunk search query and run this query: | rest /services/apps/local splunk_server=local | table title version ... View more

Hi  Your case should end with ,1=1, 100) and not 1==1,100 ... View more

Got it resolved.. corrected one bracket Thank You so much for the pointer on 'if' required everytime ... View more

OR run <splunkweb>/en-US/debug/refresh ... View more

You can also use the IN component of search. When you have select multiple items in a multi-select dropdown, they are appended in a comma separated list. Try the following.  index IN ($continent_token$) host IN ($country_token$)  Note also, you shouldn't have pipes in between search terms. ... View more

1. Please don't hijack old threads (especially ancient ones like this one) 2. You can't (reasonably) match CIDR ranges using regex. With /24 you can simply cut at last octet but with - for example /17... it's gonna be a pain in the posterior. ... View more

How would this work if the csv file is located in Splunk Cloud and needed to be copied over to our Enterprise SH ? I had a look at the documentation, but couldn`t get it working. Any help would be greatly appreciated. ... View more

@ajayabburi508  Can you please replace the below code in JS? Old: var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass(checkbox_css).click(function() {   New: var checkbox_css = selected_values_array.includes(cell.value) ? "checkbox checked" : "checkbox"; var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass(checkbox_css).click(function() {   Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

hi  https://github.com/mehransafari/Splunk_Frozen_Cleanup this is a script tha will find frozen logs older than X days and will ask you to remove them if you want  it may help you ... View more

Hi, i am facing the same issue here. I wrote multiple emails to certification@splunk.com with no reply. Can anyone please assist? Here is my case number: CASE 3031295   ... View more

@jeffland Thanks for the solution. That's exactly what I was looking for.  https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/PanelreferenceforSimplifiedXML#input_.28form.29 ... View more

Hi @p_gurav  Thank you for sharing your answer.  In my dashboard, the SPL uses saved search as well to get some data. Thus, when we use  <dashboard refresh="300"> does it run the saved search at every refresh? Or does the saved search run independently as per its pre-defined schedule only? Thank you ... View more

Hi @sandyBDF  Could you please share the solution, if you got one? Thxs ... View more

It's hard to help more without your real config and sample (scramble) data. ... View more

I'm having this same issue and it is occurring in a custom 2nd app (barebones setup).  I have the MLTK installed along with the accompanying package for scientific computing.   I've created a custom Splunk app (barebones) from the Splunk UI.  I've added a custom algorithm in the algos subdirectory and modified the algos.conf (added [MyAlgorithm]) appropriately.  When I try to call this algorithm from the Spunk UI Search box using fit it can't load the algorithm (doesn't even get to running the code). This all works fine if I do the same thing in the  Splunk_ML_Toolkit app (put the algorithm there etc).  Is there some permissions setting I'm missing or something? 02-10-2022 16:15:08.046 ERROR dispatchRunner [15506 MainThread] - RunDispatch::runDispatchThread threw error: Error in 'fit' command: Error while initializing algorithm "MyAlgorithm": Failed to load algorithm "algos.MyAlgorithm"   ... View more

I have a report that runs every day and is doing calculations based on the number of days that have occurred so far.  After pulling my hair out and using a variety of techniques posted in these forums, I ended up with: | eventstats dc(date_mday) AS daysInMonth Unless i'm mistaken, the date_* fields are automatically generated in splunk (at least all the data i've seen has them) and this was the easiest and most reliable method I found. It looks like if I use the same logic to span across months, I would simply do | eventstats dc(date_mday) AS daysInMonth BY date_month Which when my table spans a couple of months, gives me the count of days for the specific month associated with the _time field and other data for that month. ... View more

This indeed did fix the issue. Thanks for the help. ... View more

In manual detention, it will not consume new data but available for data rebalance. I would suggest to use below command for decommisioning- splunk offline --enforce-counts ... View more

Same issue, similar settings, but ours is set to 15m. The timeout has not changed and still timeouts after 1 hour. The only thing worth nothing is that we are using Okta and have SAML auth enabled. So users have to MFA to get into Splunk, but I would still think the internal Splunk settings would push the user out of the web console if set per the instructions: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Configureusertimeouts Anyone found an answer yet? ... View more

any update for splunk 8.2? where does this need to be placed? (lso it would be great if it was in the base product) ... View more

Never mind. I assumed the user already had the power role in addition to the role I was giving them to view the dashboard and underlying savedsearch results. They did not. Once I added the power role it started working. ... View more