I created some reports to populate a dashboard using some reports, but when I have two or 3 reports populating the dashboard everything goes fine but when I have many it doesn't work it doesn't load the reports in the dashboard panels. I used it like this:   { "type": "ds.savedSearch", "options": { "ref": "test_consumo_licenca_index_ultimos_30_dias_top_5" } }   Remembering that it loads when there are few reports, but when there are many, it doesn't load. Zarack_0-1709320786749.png It stays like this forever, the report has already been executed, it just needs to load the information ... View more

I need to list which data sources have datamodels, I tried a few ways but none of them were effective, can you help me please. Best regards Valderlúcio. ... View more

I have configured a Workload Rule but it doesn't work, I need all searches that last more than 3 minutes and are not from sc_admin to stop. I tested it in the laboratory and it worked, is there something wrong with my rule? (search_type=adhoc) AND NOT (role=sc_admin) AND runtime>3m Remember that I did a lab and the same rule worked. Splunk Instance version: 9.0.2305.201 Laboratory: 9.1.2308.102 Can you help me please. ... View more

I have a SH cluster with 3 servers, but I'm getting a lot of replication errors because the datamodels fill up the dispatch directory. How are jobs released from dispatch? Are files cleaned automatically? There are many bad alloc errors. Zarack_1-1699465442059.png Thanks.   ... View more

I have some Checkpoint logs (Firewall) that are generating an alert (Data hygiene - events in the future), I would like to know how I can confirm that the logs are arriving with the time in the future because they are coming with the time generated in the Checkpoint(Firewall) Zarack_1-1679574804660.png I tried using some SPLs but I don't know if that's right. Examples: SPL: | rest /services/data/indexes | search title=checkpoint | search totalEventCount > 0 | eval now=strftime(now(), "%Y-%m-%d") | stats first(maxTime) as "Earliest Event Time" first(minTime) as "Latest Event Time" first(now) as "Current Date" first(currentDBSizeMB) as currentDBSizeMB by title | rename title as "Index" | sort - currentDBSizeMB | eval "Index Size in GB"= round(currentDBSizeMB/1000,2) | table Index "Earliest Event Time" "Latest Event Time" "Current Date" "Index Size in GB" updated ======================================================================= OR this SPL: index=idx_checkpoint earliest=+5m latest=+10y | eval criationtimelog=strftime(creation_time,"%Y-%m-%d %H:%M:%S") | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | table host _time indextime criationtimelog ... View more

Hello, I have a server indexer that crashes from time to time, what is the best way to investigate what caused the problem? How can I see the logs through index=_internal and splunkd.log? ... View more

Hello Are you okay? Can you help me, I'm trying to configure the Deployer to send the Apps to the SH's but I'm getting an error when executing the command: Command: ./splunk apply shcluster-bundle -action stage --answer-yes Error: Error in pre-deploy check, uri=?/services/shcluster/captain/kvstore-upgrade/status, status=502, error=Cannot resolve hostname Tks! ... View more

I tried to do it this way, but the results don't match. How can i show the result of the first search and then the second one in columns of the correct order? | rest /services/data/transforms/lookups | table eai:acl.app eai:appName filename title fields_list updated id * | where type="file" | map maxsearches=1000 search="| inputlookup $filename$ | stats count | where count = 0 | eval lookup_vazia=$filename$" |append [ search index=_internal sourcetype=lookup_editor_rest_handler "Lookup edited successfully" | stats count by _time user namespace lookup_file | rename lookup_file as "lookup_editada" ] ... View more

We need to know how to monitor lookups created inside splunk, checking if they are empty or with errors. We use REST (| rest /services/data/transforms/lookups | table eai:acl.app eai:appName filename title fields_list updated id) to bring up all Lookups, but how can we check if the lookups are wrong or empty? ... View more