I need to check daily license consumption so I were running -  index=_internal source="*license_usage.log*" type="RolloverSummary" earliest=@d | eval _time = _time - 86400 | eval GB = round(b/1024/1024/1024, 2), Quota_GB = round(poolsz/1024/1024/1024, 2) | timechart span=1d sum(GB) as "Used Volume (GB)", max(Quota_GB) as "License Quota (GB)" | where isnotnull('Used Volume (GB)') Now I need to check what are the top servers which are consuming more license etc-  index=_internal source="*license_usage.log" type="Usage" earliest=@d latest=now | eval GB=round(b/1024/1024/1024,2) | stats sum(GB) as "Host Usage (GB)" by h | sort - "Host Usage (GB)" | head 10 | append [ search index=_internal source="*license_usage.log" type="RolloverSummary" earliest=@d latest=now | eval "Host Usage (GB)"=round(b/1024/1024/1024,2) | stats sum("Host Usage (GB)") as "Host Usage (GB)" | eval h="ALL HOSTS TOTAL" ] So It is correct or not ... View more

How will i check the data stop coming  from a particular sourcetype previously the data was coming.   source - /abc/rsyslog/log/gatewatcher/gcenter-123.log sourcetpe - gw:gcenter:103:m (working ) gw:gcenter:103 (not working) gw:gcenter:103:s_alert (not working) ... View more

I need to upgrade splunk uf in my windows VM from 8.2 version to 9.3.11 can anyone help me with the steps how will I do as I need all steps in brief and if possible please share screenshot.  Also please share the backup how will I take for 8.2 splunk universal fowarder Also I had downloaded version of 9.3.11 splunk uf  .exe file         ... View more

query is - index="_internal" source="*license_usage.log" type=Usage h="abc" earliest=-3d@d latest=@d | stats sum(b) as usage by _time | eval usage_in_GB = usage / 1024 / 1024 / 1024 | timechart span=1d sum(usage_in_GB) as usage_GB with the query I can see for specific host but I need a query to see top 10 host which are using daily more than 2gb usage while using the below am not getting the results :- index="_internal" source="*license_usage.log" type=Usage earliest=-3d@d latest=@d | stats sum(b) as usage by _time, h | eval usage_in_GB = usage / 1024 / 1024 / 1024 | where usage_in_GB > 2 | stats sum(usage_in_GB) as total_usage_GB by h | sort - total_usage_GB | head 10 ... View more

it is utilizing more memory and resource, what to be add and remove for the below query :- index=_internal source="*/var/log/splunk/health.log" node_path="splunkd" | eval component=case( match(host, "sh"), "Search Head", match(host, "ix"), "Indexer", match(host, "hf"), "Heavy Forwarder", match(host, "if"), "Intermediate Forwarder", match(host, "uf"), "Universal Forwarder", match(host, "ds"), "Deployment Server", match(host, "cm"), "Cluster Master", match(host, "dp"), "Deployer", match(host, "mc"), "Monitoring Console", true(), null() ) | stats latest(color) as status by host, component | eval "RAG Status"=status | rename host as "Host", component as "Check Items" | table Date, "Check Items", Host, "RAG Status", Comments | sort "Check Items", Host | append [ search index=_internal source="*license_usage.log" earliest=@d latest=now | stats latest(b) AS b by slave, pool | eval DailyGB=round(b/1024/1024/1024, 2) | stats sum(DailyGB) AS Total_License_Usage_GB | eval "RAG Status"=case(Total_License_Usage_GB > 7000, "red", Total_License_Usage_GB > 6000, "yellow", Total_License_Usage_GB <= 6000, "green") | eval Host="lm" | eval "Check Items"="License Master" | eval Date=strftime(now(), "%d %B'%y, %I.%M %p %Z") ] | eval email_time = strftime(now(),"%d/%m/%Y %H:%M:%S") | table "Check Items", Host, "RAG Status", Total_License_Usage_GB ... View more

splunkd is unable to restart getting an error  Error (PROD) - Unable to extend tablespace TEMP ERROR PersistentScript [xdr_splunk_rh_settings.py persistent]: solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__.. while checking the space there is 50 percent vacant  ... View more

query is something like :- `macro_1` index=abc sequenceNumber=12 `macro_2` basically the below image had 4 column as  and the events following there  If we see in the events the logs are missing for the seq no 17 & 24 and time is missing 15,16,17 and 24 also there is 15 and 16 events merge together how will I solve this    ... View more

What am following are as follows :- 1. Log into Monitoring Console :- Login to splunk cloud UI Search for cloud monitoring console under Apps  2. Check Indexing health :-           Check Indexing Performance: Go to Indexing -> Indexing Performance  Review ingestion rate trends. Identify queue buildup (parsing, indexing, or pipeline queues). 3. Monitor data inputs Go to Forwarders > Forwarders deployment  Check forwarder connectivity and status. Confirm data forwarding from Universal Forwarders or Heavy Forwarders. what other steps can be included in this  ... View more

Hi  I need the same time in events and _time  while importing the data getting the time difference what to write in time_prefix field    ... View more

Need to write a regex for  same as time and same as event given below in image    ... View more