A couple of weeks ago I took a screenshot of the "Save As Alert" window. Alert type Real-time was available. Today, my colleagues discovered that we can no longer do so, the only alert type is "Scheduled". Our admin role has the schedule_rtsearch capability set, but we are not able to find the "rtsearch" capability mentioned in the documentation as also required. Has the latest Splunk Cloud version upgrade to 9.0.2305 removed that capability? Or am I missing something?   ... View more

I have a json source with input via a Splunk Add-on for AWS input. Sometimes there's a timestamp-like field, sometimes not, so I chose to use a sourcetype with Timestamp handling set to "Current time" in the GUI which I think sets DATETIME_CONFIG=CURRENT in the sourcetype's props.conf entry.  I expected this to mean that's where the events would get their timestamp from, but log messages in splunkd.log (according to what I see in index=_internal) are still showing that DateParserVerbose is spitting out warnings that "A possible timestamp match ... is outside of the acceptable time window" occurring when events with no recognisable time are indexed. This also means that some events get seemingly random timestamps if some string gets misinterpreted; a handful of events generated yesterday had timestamps in November 2021. Was I wrong expecting a sourcetype's DATETIME_CONFIG worked that way? If not, what might be happening to stop my intended timestamping? If so, how else should I handle events with no timestamps? Thanks for any advice. ... View more

I have a timechart which I would like to chart in dashboard studio. | eval Len=length(_raw) | timechart sum(Len) AS Size count AS Count BY index Counts and Sizes should go on separate axes, obviously, but I don't understand how to get them there! I had some limited success with y2fields, but couldn't use the same format with yFields and I just don't understand "> y | getField()" controls for fields in tile options. Advice and assistance sppreciated!   ... View more

We're using Splunk Cloud 8.2.2202.1 and have a data upload issue. I can upload a CSV  using the Add Data button in Settings menu into index=sandbox, but can't upload to my newly created index=xxx. I get a "supplied index 'xxx' missing" error. After data loaded into sandbox (showing I have accounted for adding a timestamp) I can index=sandbox | collect index=xxx sourcetype=hec testmode=false to put the data into xxx which seems to me proves index=xxx exists despite the contents of the error message. 1. Can anyone suggest what I might be doing wrong in getting my csv data into the correct index without taking a detour through index=sandbox? 2. I suspect there might be more log information about the failure somewhere, but I've looked in index=_internal and have not seen anything relevant. Is there somewhere else I can look?  3. We have been maddened by a string of silent failures in our use of Splunk in the past weeks and I wonder if there isn't a logging verbosity control that we could use to make it clearer what is happening (or not happening) with our Splunk operations?  Kind Regards, Sean ... View more