Once you've exceeded the ingest limit five times you are in violation of the free license and Splunk will only let you search the internal indexes.  The fix is to wait for the violations to expire (about 30 days, IIRC) or buy a license. ... View more

Building on previous answers, use fieldformat to display Duracion in the desired way while still keeping it as a number.  Then sum their values using addcoltotals. index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810" "Call.ConnectTime"=* "Call.DisconnectTime"=* |lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | fieldformat Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duracion | addcoltotals label="Total" labelfield=Countrie Duracion   ... View more

Are you trying to capture the data in a single field or multiple fields?  Is this to be done at index time or search time? ... View more

Remove the ':' on the end of the regex and it should work. You can't get | makeresults and props to work at the same time.  makeresults creates synthetic events and props only work on real events. ... View more

I've found the custom triggers to be unreliable at best.  What works better is to put the alert condition in the search query and have the alert trigger when the number of results is not zero. ... View more

Thanks for clarifying.  Try this query. | rex mode=sed "s:<EventID>4702<\/EventID>|<TimeCreated SystemTime='[^']+'\/>|<Computer>[^<]+<\/Computer>|<Data Name='[^']+'>[^<]+<\/Data>::g" ... View more

It would help to know what you've tried already and how those efforts failed to meet expectations. Are you looking for a single regex or one for each field? Do you plan to extract the fields at search time or index time?  If search time, have you tried using spath to parse the event? rex mode=sed does not extract fields so it cannot be used to validate expressions. ... View more

Try this query index=test | stats count(eval(status>399)) as Errors,count as Total_Requests, values(Status) as list_of_Status by consumers | eval Error_Percentage=((Errors/Total_Requests)*100) ... View more

Nit: the instance is *managed* by Splunk, but it is *hosted* by either AWS or GCP.  Contact your Splunk admin if you don't know which host you have. If you're not on a trial account then the port number will be 443. Make sure the computer you are connecting from is on your Splunk Cloud Allowed IP List. ... View more

It would help if you told us a little about the issues you having rather than just saying you have issues. We also need to know which platform you use (AWS or GCP) and if it is a trial or paid account.  Those answers are used at https://docs.splunk.com/Documentation/Splunk/9.3.2/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector to determine the correct endpoint.  It could indeed be a port error. The URL from which you got a response is a REST API endpoint, not a HEC endpoint. ... View more

Don't ingest syslog directly into Splunk.  Use a dedicated syslog server.  See https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html and https://kinneygroup.com/blog/splunk-syslog/   ... View more

Enabling maintenance mode simply tells the Cluster Manager to not bother doing bucket fix-ups.  Nothing happens on the indexers themselves. The upgrade-init command starts a rolling restart of the indexers after setting maintenance mode. ... View more

I'm not sure what that statement means.  props apply only to the sourcetype, source, or host listed in the stanza name.  It may be necessary to replicate a stanza to cover all scenarios. ... View more

See the Getting Data In manual. ... View more

In Dashboard Studio it's $row.<<fieldname>>.value$. $row.host.value$ ... View more

This is a better answer than mine.  $results$ will only pick up the first result rather than the row clicked. ... View more

That is a Splunk internal index so any documentation (if it exists) would be internal to Splunk.  You may be able to find some useful information in the Troubleshooting Manual or the REST API Reference Manual. ... View more

Use $results.host$ ... View more

In addition to what @PickleRick wrote, what problem are you trying to solve?  Splunk is quite capable of parsing XML logs so why are trying to re-format them?  Why not use a transform to extract the fields directly instead of the interim SEDCMD step? ... View more

We need more information.  How data will be ingested each day?  How long will that data be retained?  How much searching will the system perform? If you have a single indexer then there is no need for a Cluster Manager (f.k.a. Cluster Master) and the search head can serve as the License Manager on such a small system.  If larger ingest amounts and for better search performance, multiple indexers may be needed, which call for a Cluster Manager. Syslog data should not sent directly to a Splunk process.  Instead, send it to a dedicated syslog server (rsyslog or syslog-ng) and write it to disk.  Have a Splunk Universal Forwarder monitor the disk and forward the data to the indexer(s). ... View more

It is possible to break events on *anything*.  It would help to see a sanitized example of the events you wish to break, but these settings should help. SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d\d:\d\d ... View more