Hello! I currently use Splunk, but people state Ignition is better.  I am trying to state why Splunk is more beneficial. I have never used Ignition, so can someone help me compare and contrast the two platforms?? I want to prove why Splunk should be used and need help. Thank you. ... View more

Splunk versions being used: Splunk Server 1 = Version 8.2.7 Splunk Server 2 = Version 8.1.1 Background: I created a service which monitors different folders for incoming data. When a user places new data into one of the folders, Splunk SPL creates a tailored message for the Virtual Machine (VM) to move the data. If message is received by VM, the VM sends the data through a TCP port to another service which verifies the data. If verified, the data will go straight to the Splunk servers via TCP/IP. Issue:  When I updated one of the servers, my whole data transfer process described above stopped working. My services cannot communicate with the VM anymore. Error Generated in Splunk Logs: 1. "It seems the Splunk default certificates are being used. If certificate validation is turned on using the default certificated (not recommended), results in loss of communication in mixed-version Splunk upgrades." 2.  "Splunk's properly implemented crypto code resulted in the ciphertext being rejected instead of decrypted when AAD validation failed." Summary of Question: Since two different versions of Splunk are running, is it affecting the Splunk SPL ability to send a message to the VM/why my VM is not communicating/working anymore? Thank you. ... View more

Hello! I am caluclating utilization (already done), but I want to fix my event start times. The start time for a run on a machine is located in the filename, but I am having difficulty doing the regrex command and understanding how it works. ex. Filename String:  013023-123141-46.xml Step1: Extract middle string (highlighted in red): 013023-123141-46.xml -->WANT:    "123141"  Step2: Add ":" between every other number (highlighted in red): "123141" --> Final string: "12:31:41" Step3: Convert time string "12:31:41" into a time stamp: Field: Starttime = strftime(Start_Time,"%h:%m:%s") ... View more

Hello! I am trying to map a search in Splunk Studio Dashboards to create a time chart showing a machines utilization per day. I want to show it by day so I can add a trend line to my single value utilization panel. To do this, I am mapping my search by day so, the utilization will be calculated per day rather than over the whole-time range. Using the code below I am able to make a time chart displaying the machines daily utilization in dashboard classic but not dashboard studios: Code: index=example |bin span=1d _time |dedup _time | eval start=relative_time(_time,"@d-1d"), end=relative_time(_time,"@d") |eval day=strftime(_time,"%D %T") |eval End=strftime(end,"%D %T") |map maxsearches=30 search="search index=example earliest=\"$$start$$\" latest=$$end$$ | transaction Machine maxpause=300s maxspan=1d keepevicted=T keeporphans=T | addinfo|bin span=1d _time | eval timepast=info_max_time-info_min_time | eventstats sum(duration) as totsum by Machine _time  |dedup Machine _time | eval Util=min(round( (totsum)/(timepast) *100,1),100) | stats values(Util) as \"Utilization\" by Machine _time date_mday" |table _time Utilization Machine |chart values(Utilization) by _time Machine |fillnull value="0" Code Results in Dashboard Classic: Code result in Dashboard Studio:   Why can't I map on Dashboard Studio?? It states it is waiting for an input. How can I break up utilization by day to show the trend line? ... View more

Hello, I am inputting a file into Splunk showing the computers system information extracted from the command prompt. The data file I am inputting input Splunk looks like the first photo below, where I want the fields to be set as the values in the first column (circled in red) and their field values equal to their corresponding output value.   YETTT, when adding it to Splunk, it breaks down the system information file into three events (instead of 1), see image below. How do I merge these three events into one (match the text file uploaded) and set the fields equal to the systems characteristics seen in the first column (circled in blue)?   ... View more

Hello! Last week (12/8/2022) my license usage went through the roof, for one source type that used 24 GB. On the other hand, when looking at the sourcetype, there were no events pulled into Splunk that day (no events since 9/16). What is the cause of this issue?? How can I see why our license usage went up?? Also -->events pulled in that day (12/8) were same number of events we get pulled in on an average day YET our license usage was at 24. Thank you.   ... View more

Hello!!! I am doing calculations for the time it takes when a machine is undergoing maintenance. Right now, I calculated the time in hours it takes for the maintenance, thus how long the machine was not in use, BUT I want the time to only show how much it was down for that specific day. My code will be based on the time column. If machine maintenance starts on one day (i.e., 9/7) but ends the next day (i.e., 9/8), I want one row to show the machine downtime for 9/7 =24 hours- time in hours when machine was being worked on AND a new row to be created for 9/8=24 hours- time down during that day CURRENTLY It gives me the time in hours in a row based on when the machine started to be working on ....current results BUT I want....   Can I have help please!!!! Code: index=.......search..... | eval open = strptime(Open_Date, "%m/%d/%Y %I:%M:%S %P") | eval close = strptime(Close_Date, "%m/%d/%Y %I:%M:%S %P") |eval Diff=round(((close-open)/3600),1) |eval CloseTime=strftime(close,"%Y-%m-%d") |eval OpenTime=strftime(open,"%Y-%m-%d") |eval Time=strftime(_time,"%Y-%m-%d") |table Time OpenTime CloseTime Close_Date Open_Date Diff ... View more