Hello I'm using Splunk cloud and I have a user that wants to export search results that contains 277,500 events He is getting TO since the file is too large. Is there a way to export the file without change the limitation ?  I cannot run curl command since we are using saml authentication    Thanks ... View more

Hello I want to monitor the health of db connect app inputs and connections and i noticed the the health monitor is not working. im getting the message "search populated no results" When i tried to investigate the issue i found out that index=_internal is empty I guess its related. Can you please help me figure out why the index is empty and the health monitor is not working ? ... View more

Hello. Im using Splunk cloud and thinking about add summary index or data model. I'm trying to understand the difference between the 3 options : summary index, report acceleration and data model. Can someone please explain to me what is the main purpose of each ? Using summary index is the best way to avoid performance issues with heavy searches ? How it works with summary index? should i create new index and run my dashboards on this index ? Thanks ... View more

Hello What is the best way to calculate sourcetypes size trend by time  index and level ?   i tried this two options but couldn't find a way to see the trend : index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 | stats sum(GB) by st idx   index=* | eval raw_len=len(_raw)/1024/1024/1024 | stats sum(raw_len) as totalsize count as NumberOfEvent by index sourcetype | sort -NumberOfEvent | fields - NumberOfEvent ... View more

Hello I have  a dashboard with few panels All the panels have drilldown tokens that updates a table also, i have few filters that supposed to update the table also but i see a message " Search is waiting for input..." when selecting options from the filters.  The tables updated only when clicking on the other panels. how can i update the table from the filters ?   Thanks ... View more

Hello I'm trying to count events by field called "UserAgent" If im searching for the events without any calculated field im getting results from different UserAgents But once im using eval, I don't get the expected results For example: I've tried this eval and im getting only "android" also im searching for "ios" only with    "ContextData.UserAgent"=*ios*   as part of my query    | eval UserAgent = if("ContextData.UserAgent"="*ios*","ios","android")    what im doing wrong ? ... View more

Hello I'm using Splunk Cloud and im looking for an option to disable multiple alert using rest api or script so it will be semi automatic  Since I'm using the Cloud, I don't have access to savedsearches.conf file. Any ideas ? Thanks ... View more

Hello Is it possible to calculate the storage that part of log is taking ?  I have a log file that contains a message that i want to calculate the storage it takes after getting the numbers, is it possible to exclude it from index ?   Thanks ... View more

Hello How can I change the owner of the alert in alert manager action ?  I have only unassigned  ... View more

Hello I have an on prem indexer which i want to shot down and move all his context to another indexer is Azure What is the best practice for that ? Thanks ... View more