Without having a sample of the events is hard to tell what is the problem. Here are some ideas: 1- Have you tried to expand the time interval? 2- Does this query return any data? If so, check if the values of req_status and attack_type are what you expect.  index=f5_index sourcetype=* req_status="blocked" attack_type=* The chart and table commands seems fine but they will only work if the first part of the query returns results. ... View more

What kind of Splunk instance is this you're trying to update? (HF, UF, Indexer, SH?) Have you tried to submit a ticket to Splunk support? They can definitely help you in this upgrade situation. ... View more

Hi, it will require a combination of props.conf and transforms.conf configs. Try these on a HF and restart it.   transforms.conf [all_logs] REGEX = . DEST_KEY = queue FORMAT = indexQueue [info_warn_discard] REGEX = (INFO|WARN) DEST_KEY = queue FORMAT = nullQueue       props.conf TRANSFORMS-routing = info_warn_discard, all_logs     ... View more

Try this config and then restart the Splunk instance. LINE_BREAKER = ([\n\r]+)confluent_kafka_server_request_bytes\{ SHOULD_LINEMERGE = false       ... View more

Hi, have you tried to repeat the installation of 9.0.4.1? ... View more

That depends on the source of the logs and how you are ingesting them into Splunk. Usually you need to configure the inputs.conf file to tell Splunk which files to ingest and which sourcetype should be applied to those files. Something like this: [monitor:///home/jenkins/folder/dir] host = <name_of_the_server_producing_logs> sourcetype = <desired_sourcetype> (can be a known sourcetype like "cisco:asa" or a custom one) index = abc disabled = false   But again this is just an example, it depends on how you are collecting the logs and Splunk has many ways to configured log collection. ... View more

Hi, That command:  "| metadata index=* type=sourcetypes" is just a way of seeing metadata on which sourcetypes are being applied in splunk. It has nothing to do with the actual events/logs of your information. For that you should search the specific indexes (e.g. index=abc) and: - first check if the important fields are correct: _time, host, sourcetype and source - second check for any field extractions, if they are also correct and then analyze if you need any more field extractions for you use cases.     ... View more

Hi, where is this information coming from? On-prem forwarder? If so, check your any recently updated inputs.conf files. Maybe there is an incorrect configuration to index all files in a folder or sub-folder. ... View more

Hi! Can you post some events(anonymized) and the spl you are running? ... View more

Great, that means the UF is working fine, communicating with Splunk and sending logs.   In index=_internal, do you see any reference to the input stanza? try searching for a portion of the path, if you can't find logs with the full path (//gtyojn201gp.kttc.aoi.com\Share\Integrations\MyLogins\out\REM*)   That should point you to the problem. ... View more

Hey! Since I was searching for this topic/solution, I'll just add what I think is the right solution for this case. To preserve the _time, host, source and sourcetype: (...) | collect index=main  output_format=hec   ------------ If this was helpful, some karma would be appreciated. ... View more

Hey! Since I was searching for this topic/solution, I'll just add what I think is the right solution for this case. To preserve the _time, host, source and sourcetype: (...) | collect index=main  output_format=hec     ... View more

Hey! Here goes some silly questions to help debug that. Is the correlation search enabled? Also check permissions. Is the search actually producing results to trigger the action? Usually correlation searches run with a time interval of the last 5min. Is your search producing results on the last 5min?   ------------ If this was helpful, some karma would be appreciated. ... View more

Hey! You need to define a drilldown with conditional tokens.  https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/tokens#Define_tokens_for_dynamic_drilldown   Also check this thread: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-set-multiple-tokens-using-quot-condition-match-quot/m-p/339968   ------------ If this was helpful, some karma would be appreciated. ... View more

I never tried to install UF on another drive other then C, but splunk service should be like any other windows service. Can you see and start splunkforwarder service in the services console? 1- Do you see any logs at all from that UF host on _internal? (if not, there is a problem with installation or running splunkforwarder service) 2- Can you successfully monitor any file in drive E? 3- Does the user you use to run splunkforwarder service, has access to the network drive you're trying to monitor?   ------------ If this was helpful, some karma would be appreciated. ... View more

If you search this you should definitely see some related logs that could point you to the problem: index=_internal sourcetype=splunkd "gtyojn201gp.kttc.aoi.com*"   ... View more