Started a google drive where people can put in their data from testing. Included prepatch data for part of our deployment. Anyone is free to deposit their own data https://drive.google.com/drive/folders/1LegN7VuOA9y8VHY5D7XjARhvVpBaciz1?usp=sharing ... View more

Why cant you put them in two different panels on the same row? ... View more

Best thing to do is to move them onto the thawed path and manually delete them when the time comes, keeping them in the default path can be tricky to get working, where as thawed it will usually be fine. We are having the same issue moving from standalone indexers to clustered indexers, we did the above and let it ride until our retention period was complete. ... View more

If you wanted to be really clever, you could create iframes for each single value field. Then put in an HTML panel with the iframe dimensions. Its how i have done it in the past. Makes it a pain to manage when you need to update something, but gets the job done. ... View more

When using list in a triggered alert, it creates "sublines" inside of a true single line. I would be like going in Excell and hitting Shift+Enter in a cell. Have you tried doing the following just for the alert? stats count(cm) as Message by logdata.machineName, logdata.projectIdentifier | (your rename statement) ... View more

Configs pertaining to an index in a cluster should always be deployed out in the same file, or along side it in a joining file. Example: App 1: IDXCluster_VolumesRestrictions_ALL Contains volumes, default path location, default retention period (indexes.conf) App 2: IDXCluster_Indexes_ALL Contains index names, paths, custom retention (indexes.conf) Remove any index configurations from your index cluster etc/apps* or etc/system/local* ... View more

What version of the Unix app are you using? Check the searches powering the tab and see what index its referring to. ... View more

Not with the current versions ... View more

Try this |inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY ... View more

You should be more than fine with going with 5 servers at 1200 SAS. A good rule of thumb is to go 1 server, 8 cores, 8 GB ram, and 1000 IOPS per 100GB daily data. Do you actually index all 500GB/day ... View more

Try not setting the timestamp format and line breaking to see if the data appears. Then add configurations one at a time until you find the broken one/ James ... View more

Hello, $SPLUNKHOME$/etc/system/local/distsearch.conf This should contain the following: servers = IP:PORT,IP:PORT,IP:PORT ... View more

Run it again without the | fields in your append. The | field means you are not transferring the time field from the timechart, you are just transferring the data field. ... View more

Yeah, i have been working on an index cluster project and wrote peers instead of heads 🙂 ... View more

While this can get a complicated, we create two dashboards, one for each role level. They can only see the dashboard assigned to their role, then you can set each drill down by each role/dashboard combination. As long as you set that each role can only view their one dashboard, should all be fine. ... View more

This started happening to us about a week ago. I am not sure if upgrading to 6.2 is going to fix this little bug. GOOD NEWS, I found what fixed it for us. Maybe it will work for yall. Look in your navigation menu to see if any label is showing up as "none" or "None". After i removed those collections from our Nav it was just fine for us. ... View more

I'm not sure if this is possible for your current environment or even recommended to do as the idea of this could collapse a star. But what about running multiple instances of Splunk on a single indexer. Point the storage to separate places, configure the server.conf and the inputs.conf differently for the multiple instances. I have done this before on search heads and locally when i am testing a new app. After you have the multiple instances open, link them up to your license and they should appear as two different indxers to split your license with. ... View more

Assuming your using pooling, then i would verify that all of your servers in the pool are running with the correct permissions. This had happened to us a couple months ago when we spun up a new search head and it was running as a user that didn't have permissions to read and write all the files in the pool. ... View more

Nothing in the back end logs, nothing in the UI. I dont see anywhere there may be a conflict. Searching works just fine. No conflicts on the indexers themselvs either. ... View more

Nothing in the UI, give me a sec and i can check the back end. ... View more