Hi @gcusello  , This is a windows monitoring not the linux monitoring if you can help me with windows add-on it would be great  ... View more

Hi @gcusello    Thanks for the reply but the problem with this solution is it will provide me the overall cpu utilization of the server but i need the cpu utilization of splunkd process on this server not the complete cpu utilization  ... View more

Hi    A very simple approach is your KPI and service health score resides in index=itsi_summary so you can use splunk API's which we use run a search and that can solve your problem  In below code write this query  index="itsi_summary" service_name="Splunk" | table alert_value _time   here in plave of search *  searchquery_oneshot = "search * | head 10 https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearchespython/  sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "lib")) import splunklib.results as results ... # Run a one-shot search and display the results using the results reader # Set the parameters for the search: # - Search everything in a 24-hour time range starting June 19, 12:00pm # - Display the first 10 results kwargs_oneshot = {"earliest_time": "2014-06-19T12:00:00.000-07:00", "latest_time": "2014-06-20T12:00:00.000-07:00", "output_mode": 'json'} searchquery_oneshot = "search * | head 10" oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot) # Get the results and display them using the JSONResultsReader reader = results.JSONResultsReader(oneshotsearch_results) for item in reader: print(item) please do upvote if it helps  @rhirasin ... View more

This will change the complete server settings which will change complete splunk search head I want this for specific dashboard  ... View more

If you want download  the app config explorer in that you can run such things like btool and other things on UI Be generous and leave a like if it helps 🙂   ... View more

  Can you send me the query how did you get this result    dallvcrfix1p 1913 dallvcrfix1p.ops.invesco.net 20     ... View more

in authorize.conf  [capability::edit_local_apps] enable = true  I think this should work just debug/refresh the system once it is done  ... View more

if you just want total use this after your query  addtotals row=f col=t labelfield=host sum(field_you_want_count) ... View more

Try this it should work  edit_local_apps Lets the user edit actions for application management. Applies only when you set the enable_install_apps setting to "true" in authorize.conf. ... View more

No you can't do this by default for this you have to create your own custom alert app. I would recommend use this custom add-on app it will help you to create the alert addon  https://splunkbase.splunk.com/app/2962/  also have a look on this video it will help you  https://www.youtube.com/watch?v=UqJAc7rpFmQ&t=185s   Let me know if it helps  ... View more

I am not sure if i have got the question correctly or not but what i understand you have to create a filter in which field is common but name is different. So what you can do is go to field mapping and rename the field and then it should work.  ... View more

I would suggest to create a new dashboard without any JS and CSS and check if it is happening in that new dashboard as well.   If you don't mind can you also share the XML code for this  ... View more

Try to add the results in some log or lookup and check the output  In case if it is empty check the data and if not try to send the alert to your mail id using  this  | makeresults | eval a = temp | table  a _time and use inline table in your alert  ... View more

Hi jimmy , So i think just index the data using first time stamp in temp index then write a spl to extract this info and push the new data inside your desired index . you can also set retention time 2-3 weeks in temp index ... View more

Kill the splunk service and restart the server It have happened with me and worked after server restart . Please do check all the crontab running on the server before reboot it will take around 4-5 mins  To reboot switch to sudo account then use the command  "reboot" ... View more

Use this if you are working on Clustered environment  |  rest /services/authentication/current-context splunk-server=local  | table username  Use this if you are working on standalone environment |  rest /services/authentication/current-context  | table username ... View more