It's been a close to a year now and I still have the same error when trying to use this app on the iPhone what gives????? @splunk Help! ... View more

Also you should define what is your synonym for “common hours”? ... View more

You could use the advanced time picker and select earliest as "@d-3d" and latest as "@d" The @d aligns to the beginning of the current day, then the -3d goes back a further 3 days (usually 72h but across daylight saving changes, these may be slightly different. The same may go for the span, so try using 3d rather than 72h. ... View more

I faced this issue, found that server.pem under /etc/auth had expired.  1) renamed server.pem 2) ran splunk restart 3) new cert got generated with 3 year extension on expiry date. Do not change any java settings if it was working before and suddenly stopped working,  check cert expiry first.   ... View more

Thank you so much PickleRick. It works for me well. I was able isolate 3 consecutive results. I appreciate ... View more

@Stives Have you gone through this troubleshooting service now add-on document? https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting  ... View more

If you're looking to reset the Splunk UF's user password, you can follow the instructions under the "Reset a lost administrator password" section on this page: Create secure administrator credentials - Splunk Documentation   ... View more

Thanks.  How about outputs of  splunk list inputstatus as @PickleRick asked? That command shows what files it has read and how much has managed. Also you could try  splunk btool inputs list monitor:///home/sicpa_operator/deploy/PROD/machine/monitoring/ --debug to see if there is somewhere defined some weird defaults for your inputs.  ... View more

If your problem is resolved, then please click one of the "Accept as Solution" buttons to help future readers. ... View more

@Stives Request you to post what you tried which fixed the issue. Accept the answer to mark the question as answered. ... View more