Adding a version eliminates that part of the message, but not the "custom JavaScript" error part. ... View more

I do this by using stats values to combine two searches, then look for differences. The basic method follows:   <basic search> | table <fields I care about> | rename <myfield_orig> as <myfield> | eval src="<an identifier for this search>" | append [ <second search> | table <fields I care about> | rename <myfield_other> as <myfield> | eval src="<an identifier for this search>" ] | fillnull value="-" <myfield> | stats values(*) as *, dc(SRC) as match_cnt by <myfield>   The key is to make sure that the fields you want to compare have the same and not contain null values.  After, you can check the SRC field for unique values, and it will tell you which search is was from. You can also filter for what is in common (match_cnt==2) or different. For your search something like this:   | inputlookup test.csv | table DNS * | rename DNS as myField | eval src="TEST" | append [ search index="myindex" | table host * | rename host as myField | src="MYINDEX" ] | fillnull value="-" DNS host | stats values(*) as *, dc(SRC) as match_cnt by myField     ... View more

It may just be you need an explicit "field" statement at the end. See: https://answers.splunk.com/answers/686813/why-is-my-alert-not-triggering.html?childToView=752021#answer-752021 ... View more

I had the same problem. My search, which generated results, but never triggered, ended with: | table Time host CPU_Load CPU_limit email_to cc_to When I changed this to explicitly add a fields statement: | table Time host CPU_Load CPU_limit email_to cc_to | fields Time host CPU_Load CPU_limit email_to cc_to I miraculously started getting alerts. ... View more

Although this is an old thread, I thought I'd add my solution. Often I want labels longer than Splunk default, but not always the full length. First, do as jihor suggested above and set the option to "ellipsisNone", that way whatever you present will show in its entirity. At/near the end of your search add (if you were using sourcetype as the label and wanted the first 25 characters) use: | eval sourcetype = if( len( sourcetype ) > 25, substr( sourcetype, 0, 25 ) +"...", sourcetype ) or whatever you want to summarize the label. ... View more

What are you looking at to see forwarder monitoring and the list of "missing" forwarders? I have only ever seen this through the monitoring console. On newer versions of Splunk the "distributed management console" has been renamed to the "Monitoring Console", but its basically the same. You get to it through a big icon on the left of the settings drop-down, below "Add Data", not in the lists Normally, I'd say you'll need to rebuild the forwarder asset table. See: http://docs.splunk.com/Documentation/Splunk/6.5.4/DMC/Configureforwardermonitoring ... View more

This behavior is common when the search is made against clustered indexers. The results seem to be returned in chunks from each indexer so overall the events are not strictly in order by time. For testing, adding "splunk_server" to the list of fields in the table command should show this. ... View more

We're seeing a lot of this after this month's Windows update. Restarting the Splunk forwarder appears to have fixed it, We also changed the service start to "delayed". See: https://answers.splunk.com/answers/200924/formatmessage-error-appears-in-indexed-message-for.html ... View more

One way to do a negative regex, if the filter is simple, is to use successive "not characters in set" groups. For example, to exclude traffic to LOCALHOST: [WinNetMon://winnetmon] .... ## do not forward packets to localhost remoteAddress="^[^1]|1[^2]|12[^7]" So we are saying anything that doesn't start with a 1 OR starts with a 1, but not followed by a 2, OR ... ... View more

The pdf export seems to have a limit of 25 column values. I'll typically sort the values, then take the " head 25 ", and add a summary table with all the values, or if really needed generate multiple panels, with 1-25 on one, 26-50 on the next, etc. Because of this I'll make 2 dashboards, one for on screen display, and another to be run automatically for export to pdf and email. ... View more

It seems that the default conf captures not just connection requests and accepts, but each packet (i.e. transport). Also, the events are duplicated in both the inbound and outbound sources. I mitigated this by replacing the existing WinNetMon stanza with: [WinNetMon://winnetmon] direction = inbound;outbound disabled = 0 index = windows packetType = accept;connect ... View more