for anyone that would like to see this work better, please consider voting for my idea here to support long query urls: https://ideas.splunk.com/ideas/EID-I-2569 to me, this is not uncommon at all.  it's a daily problem that I have to work around.   (I'm aware of the current solutions and already use them.) ... View more

If you're referring to the roles listed in the Monitoring Console then, yes.  Doing so does not change anything on the indexer itself, however. ... View more

Thanks, Does not work.  Also know following. If  src_sg_info does not exist then we know that it's no active VPN user. Does not know how to test src_sg_info existance.  Thnaks again.    Rgds Geir   ... View more

@FelixLeh no - you are absolutely right and your suggestion looks fine, but @Anud was using append and a subsearch with inputlookup and not what you suggested... ... View more

USE_LOCAL_SYSTEM Install the universal forwarder as a local system 0   The default flag on install is 0 - update the install line to flag this set to 1. This is no longer best practice for security so be prepared to update future installs to fit with best practices. ... View more

Thanks all. I ended up using a modified version of @FelixLeh ....it works well! ... View more

Thank you very much, it seems the previous recommendation works for me. ... View more

Thanks both of you guys! ... View more

Hi @maede_yavari, each Search Head Cluster requires at least three nodes not two and a Deployer as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/DistSearch/SHCarchitecture Ciao. Giuseppe ... View more

The Default index in the Splunk is the main index.  The Definition is located in the indexes.conf. defaultDatabase = <database name>  Additionally every User Role can have a custom default index assigned. You can check the default index for a user role by going into Settings -> Roles -> Your Role -> 3. Indexes Check if the default for the environment or your user role is the same as the index which the data is shown from when you search without an index. Regarding the missing fields I currently have no lead. ... View more

Thanks, Its working ... View more

Yes, that could be. Anyway, thank you very much for the help @FelixLeh  ... View more

Thank you it worked. ... View more

That worked like a charm!!  Thanks again!  ... View more

Depening on how many Apps are disregarded by the Readiness App you could check the Outlier Apps on Splunkbase. If your currently installed version supports Splunk 9.x it should support Python 3 as well. A note regarding 9.x Upgrades: While upgrading to 9.x  from 8.x or lower; check how much storage your KV Stores take up on your systems. The KV Storage gets upgraded in the process of the Update and Splunk wants to backup all Kvstores in the process. This requires at least twice the amount of storage your KVStores currently use. If you don't do so you have to manually upgrade them afterwards instead of as part of the Splunk Upgrade Process. ... View more

Hi! Is this accomplishing what you are looking for? (I assume you are working with untransformed Events here)   index=<index> <search String > "Failed" | eval Message = case(like(_raw,"%Failed Acknowledged%"),"Failed Acknowledged",like(_raw,"%UnexpectedException Caught%"),"UnexpectedException Caught",like(_raw,"%NonRetryableException Caught%"),"NonRetryableException Caught",true(),NULL) | stats count by Message    If you want to add a line that sums up the total amount of events you can add the following:   | addtotals fieldname=count col=t labelfield=Message   ... View more

@sutom - I would say the export is correct, add the [ (square brackets) and , (commas) in the exported file manually by regex replace in any advance text/code editor. This would be the simplest option to what you want to achive. You can also write a small python script to do that we well.   I hope this helps!!! ... View more

@Ashwini_5 - Here is fully dynamic query that works with N number of course and status values: | eval combined=mvzip(course, status, "|") | mvexpand combined | eval course=mvindex(split(combined, "|"), 0), status=mvindex(split(combined, "|"), 1) | chart values(status) as status over ID by course   I hope this helps!!! ... View more

Sry, my bad. It is working now.. ... View more

Thanks I didn't know that. Thought you'd have to transform it to get a result but I've checked it and you are absolutely correct! I will adjust my answer accordingly. ... View more

Though I already tried that, it was the solution to my question after all. So I'll mark your reply as the solution During my Troubleshooting I figured out that the Problem I was having wasn't about the Index but with the authentication on the Azure Platform. ... View more

Hi @andrew_nelson ,  When I do this, it tells me that datediff(unknown, integer, timestamp with time zone) doesn't exist WHERE time < dateadd('hh', datediff('hh', 0, NOW()),0)     I use Postgresql, so I use NOW() insteads of getdate() Do you have any idea, please?  ... View more

I realised my Quarter eval had an error. I tested it again. Try this instead: | eval Year = strftime(_time,"%Y") | eval Month = strftime(_time,"%m") | rex field=Year "..(?<year_short>..)" | eval Quarter = case(Month<=3,"Q1'",Month<=6,"Q2'",Month<=9,"Q3'",Month<=12,"Q4'"),Quarter=Quarter.year_short   New Complete Example: index=mydata earliest=-2q@q latest=-q@q | eval Year = strftime(_time,"%Y") | eval Month = strftime(_time,"%m") | rex field=Year "..(?<year_short>..)" | eval Quarter = case(Month<=3,"Q1'",Month<=6,"Q2'",Month<=9,"Q3'",Month<=12,"Q4'"),Quarter=Quarter.year_short | stats dc(ID) as count_earlier values(Quarter) as Quarter by Country | appendcols [ search index=mydata earliest=-q@q latest=@q | eval Year = strftime(_time,"%Y") | eval Month = strftime(_time,"%m") | rex field=Year "..(?<year_short>..)" | eval Quarter = case(Month<=3,"Q1'",Month<=6,"Q2'",Month<=9,"Q3'",Month<=12,"Q4'"),Quarter=Quarter.year_short | stats dc(ID) as count_later values(Quarter) as Quarter by Country] | eval ave_earlier=round(count_earlier/3,0) | eval ave_later=round(count_later/3,0) | eval DiffPer=round(((count_later - count_earlier) / count_earlier) * 100,0)."%" | table ReportersCountry,count_earlier,ave_earlier,count_later,ave_later,DiffPer,Quarter | rename count_earlier as Quarter." Total", ave_earlier as Quarter." Monthly Avg",count_later as Quarter." Total", ave_later as Quarter." Monthly Avg" ... View more

Thank you, that's really useful and works great! Just as a note though for anyone looking at this in future, I had to remove the 'isnotnull(in_KV)' as otherwise it only produced the results that were both in the search and KV store. As the count already gets updated and added together in the append stage, the in_KV store values can get removed (as they will have the in_search field if they need to stay in).   ... View more