How will i check the data stop coming  from a particular sourcetype previously the data was coming.   source - /abc/rsyslog/log/gatewatcher/gcenter-123.log sourcetpe - gw:gcenter:103:m (working ) gw:gcenter:103 (not working) gw:gcenter:103:s_alert (not working) ... View more

I need to upgrade splunk uf in my windows VM from 8.2 version to 9.3.11 can anyone help me with the steps how will I do as I need all steps in brief and if possible please share screenshot.  Also please share the backup how will I take for 8.2 splunk universal fowarder Also I had downloaded version of 9.3.11 splunk uf  .exe file         ... View more

query is - index="_internal" source="*license_usage.log" type=Usage h="abc" earliest=-3d@d latest=@d | stats sum(b) as usage by _time | eval usage_in_GB = usage / 1024 / 1024 / 1024 | timechart span=1d sum(usage_in_GB) as usage_GB with the query I can see for specific host but I need a query to see top 10 host which are using daily more than 2gb usage while using the below am not getting the results :- index="_internal" source="*license_usage.log" type=Usage earliest=-3d@d latest=@d | stats sum(b) as usage by _time, h | eval usage_in_GB = usage / 1024 / 1024 / 1024 | where usage_in_GB > 2 | stats sum(usage_in_GB) as total_usage_GB by h | sort - total_usage_GB | head 10 ... View more

it is utilizing more memory and resource, what to be add and remove for the below query :- index=_internal source="*/var/log/splunk/health.log" node_path="splunkd" | eval component=case( match(host, "sh"), "Search Head", match(host, "ix"), "Indexer", match(host, "hf"), "Heavy Forwarder", match(host, "if"), "Intermediate Forwarder", match(host, "uf"), "Universal Forwarder", match(host, "ds"), "Deployment Server", match(host, "cm"), "Cluster Master", match(host, "dp"), "Deployer", match(host, "mc"), "Monitoring Console", true(), null() ) | stats latest(color) as status by host, component | eval "RAG Status"=status | rename host as "Host", component as "Check Items" | table Date, "Check Items", Host, "RAG Status", Comments | sort "Check Items", Host | append [ search index=_internal source="*license_usage.log" earliest=@d latest=now | stats latest(b) AS b by slave, pool | eval DailyGB=round(b/1024/1024/1024, 2) | stats sum(DailyGB) AS Total_License_Usage_GB | eval "RAG Status"=case(Total_License_Usage_GB > 7000, "red", Total_License_Usage_GB > 6000, "yellow", Total_License_Usage_GB <= 6000, "green") | eval Host="lm" | eval "Check Items"="License Master" | eval Date=strftime(now(), "%d %B'%y, %I.%M %p %Z") ] | eval email_time = strftime(now(),"%d/%m/%Y %H:%M:%S") | table "Check Items", Host, "RAG Status", Total_License_Usage_GB ... View more

splunkd is unable to restart getting an error  Error (PROD) - Unable to extend tablespace TEMP ERROR PersistentScript [xdr_splunk_rh_settings.py persistent]: solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__.. while checking the space there is 50 percent vacant  ... View more

query is something like :- `macro_1` index=abc sequenceNumber=12 `macro_2` basically the below image had 4 column as  and the events following there  If we see in the events the logs are missing for the seq no 17 & 24 and time is missing 15,16,17 and 24 also there is 15 and 16 events merge together how will I solve this    ... View more

What am following are as follows :- 1. Log into Monitoring Console :- Login to splunk cloud UI Search for cloud monitoring console under Apps  2. Check Indexing health :-           Check Indexing Performance: Go to Indexing -> Indexing Performance  Review ingestion rate trends. Identify queue buildup (parsing, indexing, or pipeline queues). 3. Monitor data inputs Go to Forwarders > Forwarders deployment  Check forwarder connectivity and status. Confirm data forwarding from Universal Forwarders or Heavy Forwarders. what other steps can be included in this  ... View more

Hi  I need the same time in events and _time  while importing the data getting the time difference what to write in time_prefix field  Praz_123_1-1749108268066.png   ... View more

Need to write a regex for  same as time and same as event given below in image    ... View more

How we can get the health status of the HF,UF and IHF which are connected to DS while using the rest am able to see the health for the MC ,CM, LM,DS, Deployer and IDX etc but not able to get the status health which is in Red Yellow green and not getting . Rest which am using is - | rest /services/server/health on MC am able to see health status of  MC ,CM, LM,DS, Deployer and IDX but not for forwarders also while am running the same query opening any of the HF U.I am able to see there health results. ... View more