Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About sohailmohammed
sohailmohammed
Path Finder
Member since:
01-13-2022
12-09-2025
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 01-13-2022 |
Activity Feed
- Posted Re: Search Notables by Time of Comments on Splunk Enterprise Security. 12-09-2025 01:05 PM
- Posted Re: Findings Comments on Splunk Enterprise Security. 12-09-2025 01:04 PM
- Posted Re: SA-cim_vladiator not exporting configurations globally to system on Splunk Enterprise Security. 12-09-2025 01:01 PM
- Posted Re: How can I use btool to find where a specific index was created? on Getting Data In. 12-09-2025 12:48 PM
- Posted Re: How can I use btool to find where a specific index was created? on Getting Data In. 12-09-2025 12:47 PM
- Tagged Re: Splunk Security Essential - MITRE ATT&CK Matrix on Splunk Search. 08-01-2024 05:41 AM
- Posted Re: Splunk Security Essential - MITRE ATT&CK Matrix on Splunk Search. 08-01-2024 05:40 AM
- Karma Re: Issues with search head members pushing configs to captain for amartin6. 06-28-2024 12:40 PM
- Posted How to see newly created calculated field/field alias/field extraction in the logs ? on Splunk Enterprise Security. 03-01-2022 01:24 AM
- Tagged How to see newly created calculated field/field alias/field extraction in the logs ? on Splunk Enterprise Security. 03-01-2022 01:24 AM
- Tagged How to see newly created calculated field/field alias/field extraction in the logs ? on Splunk Enterprise Security. 03-01-2022 01:24 AM
- Got Karma for Re: One of the SHC member is going up and down every 5 mins in UI but shows running fine on backend CLI.. 02-18-2022 10:49 AM
- Posted Re: Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-31-2022 01:59 PM
- Posted Re: Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-31-2022 12:02 PM
- Posted Re: Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-31-2022 11:59 AM
- Posted Re: How a different users can get different results for the same query? on All Apps and Add-ons. 01-28-2022 11:43 AM
- Posted Re: Why is my REST call from one search head to another search head not returning anything? on Deployment Architecture. 01-28-2022 11:20 AM
- Posted Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-28-2022 11:02 AM
- Tagged Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-28-2022 11:02 AM
- Posted Re: Why do I get different results from save search on Splunk Search. 01-28-2022 10:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-09-2025
01:05 PM
Try this https://splunk.my.site.com/customer/s/article/Notable-Comments-are-no-longer-found-in-index-audit-or-in-incident-review
... View more
12-09-2025
01:04 PM
Follow this @jabson https://splunk.my.site.com/customer/s/article/Notable-Comments-are-no-longer-found-in-index-audit-or-in-incident-review
... View more
12-09-2025
01:01 PM
Hi, I had same error, I made it global to get rid of it. How to fix it (Choose one method): Change Permissions via GUI (Recommended): Go to Settings > Apps > Manage Apps. Find SA-cim_vladiator and click Permissions. Set "Display for" to All Apps or Global, then save. Edit local.meta File (Advanced): Navigate to the app's directory: $SPLUNK_HOME/etc/apps/SA-cim_vladiator/local/. Create or edit local.meta (or edit existing metadata/*.meta files). Add export=system under the relevant stanzas (e.g., [tags], [eventtypes]) to make them system-wide. Restart Splunk or reload configurations after changes
... View more
12-09-2025
12:48 PM
Plus you can try out Admin Little Helpers app that will give you btool access from GUI
... View more
12-09-2025
12:47 PM
/SplunkHOME/bin/Splunk btool indexes list --debug | grep your_index_name
... View more
08-01-2024
05:40 AM
@lorispiana Did you resolve this issue ? I am facing the same problem, can you please let me know. Thank you
... View more
- Tags:
- SSE
03-01-2022
01:24 AM
Hi All,
I have created a newly created field/field alias/field extraction with GLOBAL Permissions. Example | eval test="MyApp" This works fine when I use it in search but when I save it as calculated field it doesn't show up. I refreshed 10 times even cleared browser cache and logged back in. Still same issue. We don't see newly created KO in the logs but can run those in searches.
Any inputs or help @woodcock @Splunkers 2022
... View more
Labels
01-31-2022
01:59 PM
same search, same role, same permission, same time and same search head. Thank you
... View more
01-31-2022
12:02 PM
| rest splunk_server=local /servicesNS/-/-/data/ui/views | stats count by label, title, eai:appName, author results for user1: 580 results for user2: 600 same search same role same time and same search head.
... View more
01-31-2022
11:59 AM
Same search , same time range, same search head and same role.
... View more
01-28-2022
11:43 AM
Hey Madhan45, Did you resolve this issue ? I am facing the same issue here. I have users with same roles but gives different results on same search head. Please let me know
... View more
01-28-2022
11:20 AM
Hello there, I am facing the same issue here.. I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 305 on same h1 search head. What may be the problem ? Also if I get 300 results on SH H1, I see different count on H2 with 310 results.. what is the issue here for this inconsistencies ?
... View more
01-28-2022
11:02 AM
Hello there, I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 305 on same h1 search head. What may be the problem ? Also if I get 300 results on SH H1, I see different count on H2 with 310 results.. what is the issue here for this inconsistencies ?
... View more
- Tags:
- search head cluster
Labels
- Labels:
-
using Enterprise Security
01-28-2022
10:58 AM
Hello there, I am facing the same issue here.. I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 305 on same h1 search head. What may be the problem ? Also if I get 300 results on SH H1, I see different count on H2 with 310 results.. what is the issue here for this inconsistencies ?
... View more
01-25-2022
07:33 AM
1 Karma
The solution to the above issue was to create ssl cert that fixed it although my internal certs for the server were not expired. I just recreated the certs on all SHC members and did the kv store clean up on the one which was stuck. And it got resynched in 20 mins 🙂 Recreating certs with ./splunk createssl To check expiration: openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem cd /opt/splunk/etc/auth && /opt/splunk/bin/splunk createssl server-cert -d . -n server
... View more
01-24-2022
11:47 AM
On of the SHC member is going up and down every 5 mins. KV Store is stuck at starting first and then it is stuck at intial sync. The member is running fine from backend and going to up and down in the search head clustering page. I did try splunk restart on that member server and then the KV are rebuilding and getting stuck at each phase first at starting and now at the inital sync. Any help/inputs appreciated @rbal_splunk Thank you
... View more
- Tags:
- kv store
Labels
- Labels:
-
search head clustering
