Hi All, I am using base search , I want to use time picker(earliest and latest) in other panel which is using this base search. How can I achieve that ? Reference query :     <form version="1.1" theme="dark"> <label>Test Dashboard</label> <description>Dashboard created for testing purpose</description> <search id="base_12"> <query> index=test_index </query> <earliest>0</earliest> <latest></latest> </search> <fieldset submitButton="true" autoRun="true"> <input type="time" token="time"> <label>Time Picker</label> <default> <earliest>-7d@w0</earliest> <latest>@w0</latest> </default> </input> <search base="base_12"> <query>| search (($app$) AND ($environment$))| stats count by test | fields test</query> </search>     Regards, NVP ... View more

Hi All, I have setup a universal forwarder in windows machine to monitor static file which is in json format. The logs are being forwarded but the point is it is forwarded as single event like below :     {"Env": "someenv12”, "Name": "test12”, "feature": "TestFeature12”, "logLevel": "info", "Id": "1234", "date": 1652187242.57, "productName": “testproduct”, "process_name": “test process, "pid": 695, "process_status": "sleeping", "process_cpu_usage": 0.0, "process_ram_usage": 0.0, "metric_type": "system_process"} {"Env": "someenv1”3, "Name": "test13”, "feature": "TestFeature12”, "logLevel": “error”, "Id": "234", "date": 1652187342.57, "productName": “testproduct12”, "process_name": “test process, "pid": 685, "process_status": "sleeping", "process_cpu_usage": 0.0, "process_ram_usage": 0.0, "metric_type": “application_process} {"Env": "someenv14”, "Name": "test14”, "feature": "TestFeature13”, “info”: “error”, "Id": "2344", "date": 1672187342.57, "productName": “testproduct13”, "process_name": “test process, "pid": 695, "process_status": "sleeping", "process_cpu_usage": 0.0, "process_ram_usage": 0.0, "metric_type": “security”}     This entire thing is coming as one event. I have applied line breakers in props.conf file :     [test_sourcetype] SHOULD_LINEMERGE =false NO_BINARY_CHECK=true BREAK_ONLY_BEFORE={"Env" MUST_BREAK_AFTER=\"\} TIME_PREFIX=date TIMEFORMAT=%s%4N MAX_TIMESTAMP_LOOKAHEAD = 14     I have added it under /SplunkUniversalForwarder/etc/apps/splunk_TA_windows app/local/props. None of my line breaking is getting applied , please help me on this. Should I add props.conf under default folder ? Regards, NVP ... View more

Hi All, I have created a summary index . I am making use of "sistats count by <fields>" to populate all the fields required. And I see those fields as well.  The issue is - On this index I am trying to use chart command and also stats count(<field>) as test (chart command in one query and stats count in another query) but its not working. There is no results returned. Instead I use stats command and populate data to summary index , both commands are working. Please let me know why chart and stats command are not working on the summary index that I have created using sistats command . [sichart as well not working]. I am missing some technical information here. Regards, PNV ... View more

Hi All, what does  eliminated_buckets mean in splunk index=_internal <sourcetype> mean in splunk ? Regards, NVP ... View more

Hi All, I have installed splunk UF on windows . I have one static log file in system (json)  and that need to be monitored.   I have configure this in inputs.conf file. I see only system/application and security logs being sent to indexer whereas the static log file is not seen. I ran "splunk list inputstatus" and checked,    C:\Users\Administrator\Downloads\test\test.json file position = 75256 file size = 75256 percent = 100.00 type = finished reading   So, this means the file is being read properly. What can be the issue that I dont see test.json logs at splunk side ? I tried checking index=_internal at indexer but not able to figure out what is causing issue, I checked few blogs on Internet as well. Can anyone please help on this. Thanks in Advance, Newbie to splunk ... View more

Hi Team, I am installing splunk universal forwarder using ansible : When I am trying to start splunk and accept license, I am getting below error : ``` fatal: [Server-a]: FAILED! => {"changed": true, "cmd": ["/opt/splunkforwarder/bin/splunk", "start", "--accept-license", "--answer-yes", "--no-prompt"], "delta": "0:00:00.130544", "end": "2022-04-16 17:17:20.807732", "msg": "non-zero return code", "rc": 1, "start": "2022-04-16 17:17:20.677188", "stderr": "\n-- Migration information is being logged to '/opt/splunkforwarder/var/log/splunk/migration.log.2022-04-16.17-17-20' --\nERROR while running renew-certs migration.", "stderr_lines": ["", "-- Migration information is being logged to '/opt/splunkforwarder/var/log/splunk/migration.log.2022-04-16.17-17-20' --", "ERROR while running renew-certs migration."], "stdout": "\nThis appears to be an upgrade of Splunk.\n--------------------------------------------------------------------------------)\n\nSplunk has detected an older version of Splunk installed on this machine. To\nfinish upgrading to the new version, Splunk's installer will automatically\nupdate and alter your current configuration files. Deprecated configuration\nfiles will be renamed with a .deprecated extension.\n\nYou can choose to preview the changes that will be made to your configuration\nfiles before proceeding with the migration and upgrade:\n\nIf you want to migrate and upgrade without previewing the changes that will be\nmade to your existing configuration files, choose 'y'.\nIf you want to see what changes will be made before you proceed with the\nupgrade, choose 'n'.\n\n\nPerform migration and upgrade without previewing configuration changes? [y/n] y\n\nMigrating to:\nVERSION=8.2.4\nBUILD=87e2dda940d1\nPRODUCT=splunk\nPLATFORM=Linux-x86_64\n\n\nERROR: In order to migrate, Splunkd must not be running.", "stdout_lines": ["", "This appears to be an upgrade of Splunk.", "--------------------------------------------------------------------------------)", "", "Splunk has detected an older version of Splunk installed on this machine. To", "finish upgrading to the new version, Splunk's installer will automatically", "update and alter your current configuration files. Deprecated configuration", "files will be renamed with a .deprecated extension.", "", "You can choose to preview the changes that will be made to your configuration", "files before proceeding with the migration and upgrade:", "", "If you want to migrate and upgrade without previewing the changes that will be", "made to your existing configuration files, choose 'y'.", "If you want to see what changes will be made before you proceed with the", "upgrade, choose 'n'.", "", "", "Perform migration and upgrade without previewing configuration changes? [y/n] y", "", "Migrating to:", "VERSION=8.2.4", "BUILD=87e2dda940d1", "PRODUCT=splunk", "PLATFORM=Linux-x86_64", "", "", "ERROR: In order to migrate, Splunkd must not be running."]} ``` This error not happens everytime. First time when I run the script it doesnot throw this error and runs successfully. If I run second time on same host, it shows this error . Can someone help me to understand this please ??? ``` command I am using :  /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes Thanks in Advance, Poojitha  ... View more