In python.log we are hitting some local size limit imposed by the email server: index=_internal source=*python.log* "Message exceeds local size limit" The 552 error was generated by the receiving SMTP email server complaining that the email hit the size limit on the server. Every mail server has custom settings for the size of mail users can send and receive through it. These limits can either be global or individual-account specific or both. In an Exchange server, there are mainly 4 settings for message size limitations: a. Global value for the mail server b. Receive and Send Connectors setting c. SMTP Virtual Server setting d. Individual user mailbox restriction If the message size in the email exceeds any of these limits that are allowed for a particular email user account, it will be rejected with this error 552 message. To resolve a valid email bouncing with error 552, these attachment limits have to be increased or adjusted appropriately. You could contact the mail system admin to better understand limits for email attachments. ... View more

Hi @Learner, you have two solutions: a scheduled script that moves the files from var/run/splunk/csv to another folder; modify the python script that creates the csv. The second is really difficoult, but the first it's easy. Ciao. Giuseppe ... View more

Query which I specified, is my actual query.  ... View more

  bin _time span=1d   Snaps all values of _time to the start of day i.e. 00:00 so you will not see 04:36. Also, the time format you seem to be expecting is not the format you have used for Time. Apart from that, you should get counts for the days present in your search, except when you have removed all the events for any particular day. The stats are grouped by Time and there are no values for Time once you have filtered out all the response_code1=200 ... View more

1. You dont need to use \\ but only single \ 2. The last quote (") should not be escaped with \\ Please see below sample |makeresults|eval _raw="{\"data\":{\"correlation_id\":\"51g0d88f-3ab8-4mom-betb-b31ed6e1662z\",\"u_originator_uri\"" |rex "correlation_id\":\"(?<CorrelationId4>[^\"]+)" ... View more

The bin command rounds off _time values to the day so all events that happen on the same day will have the same timestamp (2020-12-08T00:00:00 today, for example).  The range(_time) function will return 0 on any given day. To get hourly data, however, one should use span=1h rather than span=1d and use _time in the by clause of the final stats. ... View more

Hi @Learner , If I understood your question right, you could use this cron expression to schedule your search to run on the first day of the month at 00:00.   0 0 1 * *   You can check a more detailed explanation and test new cron expressions on this site: https://crontab.guru/#0_0_1_*_* But if the report needs to search a period between the 1st day and the 15th day of previous month, your should use the earliest and latest time in your search query (Or select it in your time picker):   ...YOUR SEARCH... earliest=-1mon@mon latest=-1mon@mon+1296000   ... View more

Glad that the initial problem is fixed. Please have a look at this - https://community.splunk.com/t5/Getting-Data-In/How-to-overcome-CSV-max-results-to-email/td-p/319484 ... View more

What is it that you are trying to achieve because a lot can be done with css and/or javascript to modify/tweak the appearance of dashboards. ... View more

i want an query for this, without using rest command   ... View more

Hello @Learner, at first you need to setup the monitoring console: https://docs.splunk.com/Documentation/Splunk/8.0.5/DMC/DMCoverview If you have a distributed environment heres a guide: https://docs.splunk.com/Documentation/Splunk/8.0.5/DMC/Configureindistributedmode   The monitoring console is a Splunk Enterprise monitoring tool. It lets you view detailed topology and performance information about your Splunk Enterprise deployment.  The search is taken from the monitoring console. You can find the search performance dashboards at "Search->Activity".  The macro is defined in the context of the monitoring console.  I hope this helps you.   ... View more

Hi @Learner, You don't need to use it, but you can find the searches for your need and use it outside the app. So e.g. for the dashboard in time you can use a search like this (this one or something similar): index="_internal" source=*access.log user!="-" */app/* | rex field=referer "/en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" | timechart span=1h dc(dashboard) e.g. to have the top 10 used dashboards, you can use something similar to this: index="_internal" source=*access.log user!="-" */app/* | rex field=referer "/en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" | top 10 dashboard  this kind of dashboard are very useful to understand how to do a thing for your need not to be used as they are. Ciao. Giuseppe ... View more