Hi All, I’m looking for an SPL query that can return the list of Tag Names along with their associated field-value pair definitions (similar to what we usually see under Settings → Tags → List by Tag Name in Splunk). I tried exploring a few REST commands, but none of them showed the field-value pair definitions. Is it possible to retrieve these details   Regards, VK ... View more

Hi All, I am using the base search and post-process searches outlined below, along with additional post-process searches in my Splunk dashboard. The index name and fields are consistent across all the panels. I have explicitly included a fields command to specify the list of fields required for the post-process searches. However, I am observing a discrepancy: the result count in the Splunk search is higher than the result count displayed on the Splunk dashboard. Could you help me understand why this is happening ? base search:- index=myindex TERM(keyword) fieldname1="EXIT" | bin _time span=1d | fields _time, httpStatusCde, statusCde, respTime, EId Post process search1:- | search EId="5eb2aee9" | stats count as Total, count(eval(httpStatusCde!="200" OR statusCde!="0000")) as failures, exactperc95(respTime) as p95RespTime by _time | eval "FailureRate"= round((failures/Total)*100,2) | table _time, Total, FailureRate, p95RespTime | sort -_time Post process search2:- | search EId="5eb2aee8" | stats count as Total, count(eval(httpStatusCde!="200" OR statusCde!="0000")) as failures, exactperc95(respTime) as p95RespTime by _time | eval "FailureRate"= round((failures/Total)*100,2) | table _time, Total, FailureRate, p95RespTime | sort -_time ... View more

Hi Team, We are trying to extract JSON data with custom sourcetype and With the current configuration, all JSON objects are being combined into a single event in Splunk. Ideally, each JSON object should be recognized as a separate event, but the configuration is not breaking them apart as expected   I observed that each JSON object has a comma after the closing brace }, which appears to be causing the issue by preventing Splunk from treating each JSON object as a separate event. sample data :  { "timestamp":"1727962122", "phonenumber": "0000000" "appname": "cisco" }, { "timestamp":"1727962123", "phonenumber": "0000000" "appname": "windows" },  Error message : Error message : JSON StreamID:0 had parsing error: Unexpected character while looking for value comma ',' Thanks in advance ... View more

Hi All, We are in the process of onboarding logs from a centralized log server, where all endpoints forward their logs. We have installed a Splunk Heavy Forwarder on the server to monitor and forward these logs to the Indexers. I would like to know if there are any default sourcetypes available for data sources such as systemd.log and sudo.log   ... View more

Hi Team, We are using add-on to collect the Azure metrics through REST API. Data is getting ingested into Splunk cloud. However, we are seeing a lag of exactly 4 hours. Splunk Cloud is in UTC time zone. We have set the TZ=UTC  in HF apps/ local/props.conf as application is writing in UTC time. However, there is a lag in Splunk cloud.  https://splunkbase.splunk.com/app/3110 Any help is highly appreciated. ... View more