Hey @vrmandadi, To convert epoc time to human readable format you will have to create props.conf before indexing your data. Please update these setting in your props.conf for respected app: [Your_Sourcetype] DATETIME_CONFIG = INDEXED_EXTRACTIONS = json KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true TIME_FORMAT = %s%3N TIME_PREFIX = \/Date category = Structured disabled = false pulldown_type = true Let me know if this works. ... View more

Hi Chli, Thank you for your answer. If Addons built by Add-on Builder cannot support Splunk Cluster, then I was wondering how Splunk Add-on for ServiceNow works on Splunk Cluster? ... View more

Hi kishan2356, Is your search dependent on the tokens that you are applying? ... View more

Hi nkumar6, You can try the search below for last 7 days to compare 7 days data. Splunk Query: index=abc source=item_count |dedup item | timechart span=1d count by item ... View more

Hi manderson_rr, Your schedule in inputs.conf should be in a cron format. Like if you want the script to run for every 5 minutes your schedule should be equal to the examples in the link below: https://www.thegeekstuff.com/2011/07/cron-every-5-minutes/ Also you can add index in your inputs.conf if you want a separate index for the processes you are monitoring. And if you are adding a custom index don't forget to create this custom index on search head as well. ... View more

Hi balash1979, You can also directly extract fields from your search via Splunk UI using "Extract Fields". You can also check if your extractions are matching every field in the events. You can refer the Splunk doc for the same: https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/FXSelectSamplestep ... View more

Hi kimle, While uploading .csv file as a lookup in Splunk, it should be in a proper csv format. You should have your field in source_address and dest_address one after the other and not in a single sentence. The CSV file cannot contain non-utf-8 characters. Plain ascii text is supported, as is any character set that is also valid utf-8. And then you can try uploading your csv as a lookup and check the result. Let me know if you have any questions. ... View more

Hi, Don't run your search completely but try running it part by part so that you can find which part of your search is going wrong. ... View more

HI, The master is essential to the proper running of an indexer cluster, with its role as coordinator for much of the cluster activity. However, if the master goes down, the peers and search head have default behaviors that allow them to function fairly normally, at least for a while. Nevertheless, you should treat a downed master as a serious failure. To deal with the possibility of a downed master, you can configure a stand-by master that can take over if needed. You can go through the link below of Splunk docs for how to do this: https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Whathappenswhenamasternodegoesdown ... View more

Hi, Kindly check the link below on Splunk answers. It might help you. https://answers.splunk.com/answers/198494/colouring-header-of-the-table-in-splunk.html ... View more

Hi, When you run the 2nd search do you get any output or only annotation disappears? ... View more

Hi, You can check the accepted answers in the link below. It might help you https://answers.splunk.com/answers/374936/why-am-i-unable-to-viewdelete-a-users-dashboardsre.html ... View more

Hi, Try sending your backup file to temp folder of your destination and then move it to respected path. ... View more

Hi Fridays, How are you searching your fields? If you want to see all selected fields you need to search it in verbose mode and also make sure the coverage selected is "All Fields" ... View more

Hi, I hope you have followed the steps in below splunk documentation https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/Self-signcertificatesforSplunkWeb Also you can check below links on splunk answers if it helps you. https://answers.splunk.com/answers/490127/when-trying-to-create-a-self-sign-certificate-why.html https://answers.splunk.com/answers/225486/generate-self-signed-certificate-windows-is-there-1.html ... View more

Hi, Yes, this is a bug This and fixed in 6.6.4 and 7.0.1: http://docs.splunk.com/Documentation/Splunk/6.6.4/ReleaseNotes/6.6.4#Admin_and_CLI_issues ... View more

Hi, If you want multiple tokens to be selected then in dropdown you will have to select "multiselect" and accordingly you will have to modify your search PFB link on splunk answers, it might help you with this. https://answers.splunk.com/answers/592982/using-input-from-a-multi-select-input-field-for-po.html ... View more