Below given is one section of an event. The event has multiple such sections. I want to write a regex search query so that I can fetch the 3 fields from the below given log 1) 'Tableau Server (Service) ' (PD) is (Status). 2018-05-25 02:21:30.270 -0500_EXACT_10.218.108.14:RTEEPK08_:pid=12466_0x4364712fuser=request=_ RTEEPK08: Status: DEGRADED 'Tableau Server Data Engine' (7653) is running. 'Tableau Server Coordination Service 0' (7633) is running. 'Tableau Server Search and Browse 0' (2542) is running. 'Tableau Server Tabadmin Service 0' (25262) is running. 'Tableau Server Gateway' (252564) is running. 'Tableau Server Cluster Controller' is stopped. 'Tableau Server Repository' status is not available. 'Tableau Server File Store' status is not available. RTEEPK09: Status: STOPPED RTEEPK10: Status: STOPPED I already wrote a regex query to extract it in the form of table for host and Status. But I am having problems in writing the regex query for 'Tableau Server (Service)' (PD) is (Status). Extract - (Service), (PD) and (Status) Thank you Note: This is a sample modified log file ... View more

Currently, we have splunk 6.4 installed on our distributed enviroment. In our enviroment, we have 3 search heads, 2 indexers and 1 master server that act as licensing and deployment server and 1 heavy forwarder. We need to upgrade to Splunk 6.5. The search heads and indexers are in clustered. How do I go ahead ? What would be rollback options. ... View more

I am getting the error "Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member" I tried to run the following command # splunk resync shcluster-replicated-config but i am getting the error "Cannot resync_destructive: this instance is the captain" I then tried to perform the rolling restart among search head cluster, run the following command # splunk rolling-restart shcluster-members But still I am getting the error "Error pulling configurations from the search head cluster captain" I also ran splunk resync shcluster-replicated-config after rolling-restart. But still not fix. and I am getting above errors Please suggest a fix ... View more

I have wrote a query to find out the license usage by host. But I need to find out the top 10 hosts or indexes in terms of license usage. I have written the following query. index=_internal source="*license_usage.log" | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | rename MB as "License Consumption (MB)" The above query gives me license usage of all the hosts. I need to find top 10 hosts or indexes. ... View more

It was working earlier. But for the last 27 days, it is been displaying output as "No Results" for some of the label like "Maximum CPU utilization" and Minimum CPU utilization and Total Requests and Unreserved Requests. All the rest are working fine and displaying results. When I look deeper into the search query that populates CPU utilization and Requests, I found aws-cloudwatch is being used. But when I click on configure, I see the following error Unexpected error occurs. In handler 'splunk_app_aws_proxy_inputs': Unexpected error "" from python handler: "HTTP 500 Internal Server Error -- In handler 'cloudwatch': External handler failed with code '1' and output: 'REST ERROR[404]: Resource/Endpoint requested dose not exist - https://127.0.0.1:8089/servicesNS/nobody/Splunk_TA_aws/data/inputs/aws_cloudwatch?output_mode=json&sort_key=name&offset=0&sort_dir=asc&count=0'. See splunkd.log for stderr output.". See splunkd.log for more details. Cloudwatch is listed there but no data input. How do i go ahead with this ? Please help ... View more

I have installed REST API modular input on the Search Head cluster. how do I configure it ? The data input. We have a management server, 3 search head, 2 indexes and 1 heavy forwarder. Where do I install the REST API modular input and how do I configure it. ... View more

I need to know the license usage of 5 indexes on a daily basis. All the options I have been trying gives me the license usage of all the indexes. ... View more