Hi,   I have this props and transforms file to filter out the events before they reach the indexqueue. Not sure but the filter doesn't seem to work any more.  When I use btools to check the configurations, I still notice the configuration in place. We recently upgraded Splunk version to 9.0.4 from 8.1.0 a month ago to check if this has some effects on the configurations but it doesn't have any  What could be the reason ... View more

Hi,   We have been using Splunk Enterprise version 8.1.0 and planning to upgrade to version 9.x but there seems to be some sort of an issue. We have a choice tag with collapse and expand options but that doesn't seem to work when migrating to 9.0.2 or even 9.0.4 version but works perfectly fine in 8.1.5 version. Has anyone faced a similar issue or is there some workaround to fix this ?   Regards, Pravin ... View more

Hi Community,   I have a Splunk dashboard which consists of panels that depend on one another in a top-down manner. The data for the panels are powered by accelerated data from the data models. When I initially set the token, the first panel loads with incomplete data, then takes a few seconds to load the complete list of data. So the rest of the panels won't load until the first panel loads completely and shows messages like "Invalid earliest time" OR "waiting for data". Is this an ideal behavior or is there something that needs to be changed?   Regards, Pravin ... View more

Hi Community,   I have a use case where the client needs data to be stored over an extended period of time. The main objective is to test if I can use a combination of SSD and HDD for this use case. Also, make sure that when the data is available in the HDD over the Network File System, the dashboards powered by data models work. Since the client wants data to be available for at least 6 months, an index is created that has hot/warm buckets in SSD and cold buckets in slower storage connected over the Network File System. For this test, I have created a new index that has a bucket size of 500 Mb and the number of hot buckets is 2 and there are no warm buckets. I have made no other changes to the default configurations. When the data is available in hot/warm buckets, the data models work and the panels are loaded. But when the data is moved to HDD, the panels don't work.  I get an error as attached above. When I run a search query I can see data. Could you please let me know how can I fix this issue?   Regards, Pravin     ... View more

Hi Community,   I have a dashboard that gives me an overview of the details. When I click on one of the rows it drives me to a different dashboard which takes time from this dashboard and performs a granular search within time limits based on parent ID. This search performs a search on a panel that shows no data at all. When I try to look at the SPL of the empty dashboard, I realise that the SPL does search on milliseconds. This search is within the range of 1 second. This search is driven by a data model acceleration which can accelerate only for seconds. So if the change the time range for more than a second I get the desired results.   To fix this issue, the only option I can think of is reconstructing the SPL without data models but that will slow down the search or manipulate the time range so that I can get the data. Is there some other option which I can use to get the desired results? Thanks in advance.   Regards, Pravin       ... View more

Hi,   I moved the installation Splunk folder by mistake into another folder because Splunk stopped working. Since, I had moved the folder to a different location, tried to copy it back but the copy failed and became a partial copy. So I upgraded to the latest version of Splunk and tried to start Splunk.   When I try to start Splunk, I get the following error   Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Text decryption - error in finalizing: No errors in queue AES-GCM Decryption failed! Decryption operation failed: AES-GCM Decryption failed!    Also, it is asking for   All preliminary checks passed. Starting splunk server daemon (splunkd)... Enter PEM pass phrase:   Even if I don't enter anything, the Splunk server starts running but the GUI is not available and gives me 500 internal server error. Not sure what configuration file was changed during the process.   Regards, Pravin   ... View more

Hi,   In the above figure, I save the test results using a save ID and then I get a list of ID's like the one below. But when I click on 'save new test', it doesn't work. I have the same code on the test site as well where it works as usual. A sample xml code is provided as well. <panel depends="$host_token$"> <title>Save Test</title> <!--When button is pressed the the token execute_save_test is set up with a outputlookup at the end, this is used later on to push the data back into the lookup in order--> <input type="text" token="save_test_name_token" searchWhenChanged="true"> <label>Test_Name</label> </input> <input type="text" token="save_test_comments" searchWhenChanged="true"> <label>Comments</label> <default>-</default> </input> <input type="dropdown" token="save_test_status" searchWhenChanged="true"> <label>Mark test as gold, bad test or ordinary</label> <choice value="ORDINARY">ORDINARY</choice> <choice value="GOLD">GOLD</choice> <choice value="BAD TEST">BAD TEST</choice> <default>ORDINARY</default> </input> <html> <button class="btn" data-token-json="{&quot;execute_save_test&quot;:&quot;| eventstats max(ID) as max_ID | eval ID = if(isnull(ID),max_ID + 1,ID) | fields - max_ID | dedup ID | outputlookup Saved_Tests.csv&quot;}">Save new test</button> </html> <html depends="$saved_test_id$"> <button class="btn" data-token-json="{&quot;execute_save_test&quot;:&quot;| eval ID = if(isnull(ID),$saved_test_id$,ID) | dedup ID | outputlookup Saved_Tests.csv&quot;}">Update current test (ID: $saved_test_id$)</button> </html> </panel>   Could someone please advise what has gone wrong?   Regards, Pravin     ... View more

Hi Community, I have an SPL query that runs from a savedsearch in Splunk Enterprise. When I run the query I am able to get the output but when I try to run the same query from the Linux server using a curl command I do not get any response. I have verified if the curl is able to connect to the API and obtain a response by getting the status code in the output. Example of the curl command: /usr/bin/curl -sSku username:password https://splunk:8089/servicesNS/admin/search/search/jobs/export -d search="| savedSearch Trading_test host_token=MTE_MTEDEV_Greening time_token.earliest=-30d time_token.latest=now " -d output_mode=csv -d exec_mode=oneshot > output.csv I was trying to break the problem to check where it might have gone wrong. I found that the savedsearch I was using had a table command to limit the number of columns generated. So I created a new savedsearch to without any tables and I was able to get the output as raw data. This is such unusual behaviour that I am not able to figure out what would have gone wrong. Could anyone let me know why is this causing a problem? Are there some other alternatives that I can use to fix this problem? Thanks in advance.   Regards, Pravin       ... View more

Hi Community,   We have encountered a weird case with the curl command. One of the users was running a curl command to get a response from a server and run an SPL search on it. Since the time limit was not mentioned on the curl command, the response was used to go back in time and retrieve all the data ever produced from the URL. This process would take time to retrieve information and would die in the server. This was found once we had a slowness issue with the server and had added the time parameters. Now the issue with slowness is fixed. However, I would like to check on the possibility to get the list of curl commands executed in Splunk. Or are some other alternatives to get the list of curl commands getting executed in Splunk? Thanks in advance.   Regards, Pravin ... View more