query is - index="_internal" source="*license_usage.log" type=Usage h="abc" earliest=-3d@d latest=@d | stats sum(b) as usage by _time | eval usage_in_GB = usage / 1024 / 1024 / 1024 | timechart span=1d sum(usage_in_GB) as usage_GB with the query I can see for specific host but I need a query to see top 10 host which are using daily more than 2gb usage while using the below am not getting the results :- index="_internal" source="*license_usage.log" type=Usage earliest=-3d@d latest=@d | stats sum(b) as usage by _time, h | eval usage_in_GB = usage / 1024 / 1024 / 1024 | where usage_in_GB > 2 | stats sum(usage_in_GB) as total_usage_GB by h | sort - total_usage_GB | head 10 ... View more

it is utilizing more memory and resource, what to be add and remove for the below query :- index=_internal source="*/var/log/splunk/health.log" node_path="splunkd" | eval component=case( match(host, "sh"), "Search Head", match(host, "ix"), "Indexer", match(host, "hf"), "Heavy Forwarder", match(host, "if"), "Intermediate Forwarder", match(host, "uf"), "Universal Forwarder", match(host, "ds"), "Deployment Server", match(host, "cm"), "Cluster Master", match(host, "dp"), "Deployer", match(host, "mc"), "Monitoring Console", true(), null() ) | stats latest(color) as status by host, component | eval "RAG Status"=status | rename host as "Host", component as "Check Items" | table Date, "Check Items", Host, "RAG Status", Comments | sort "Check Items", Host | append [ search index=_internal source="*license_usage.log" earliest=@d latest=now | stats latest(b) AS b by slave, pool | eval DailyGB=round(b/1024/1024/1024, 2) | stats sum(DailyGB) AS Total_License_Usage_GB | eval "RAG Status"=case(Total_License_Usage_GB > 7000, "red", Total_License_Usage_GB > 6000, "yellow", Total_License_Usage_GB <= 6000, "green") | eval Host="lm" | eval "Check Items"="License Master" | eval Date=strftime(now(), "%d %B'%y, %I.%M %p %Z") ] | eval email_time = strftime(now(),"%d/%m/%Y %H:%M:%S") | table "Check Items", Host, "RAG Status", Total_License_Usage_GB ... View more

splunkd is unable to restart getting an error  Error (PROD) - Unable to extend tablespace TEMP ERROR PersistentScript [xdr_splunk_rh_settings.py persistent]: solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__.. while checking the space there is 50 percent vacant  ... View more

query is something like :- `macro_1` index=abc sequenceNumber=12 `macro_2` basically the below image had 4 column as  and the events following there  If we see in the events the logs are missing for the seq no 17 & 24 and time is missing 15,16,17 and 24 also there is 15 and 16 events merge together how will I solve this    ... View more

What am following are as follows :- 1. Log into Monitoring Console :- Login to splunk cloud UI Search for cloud monitoring console under Apps  2. Check Indexing health :-           Check Indexing Performance: Go to Indexing -> Indexing Performance  Review ingestion rate trends. Identify queue buildup (parsing, indexing, or pipeline queues). 3. Monitor data inputs Go to Forwarders > Forwarders deployment  Check forwarder connectivity and status. Confirm data forwarding from Universal Forwarders or Heavy Forwarders. what other steps can be included in this  ... View more

Hi  I need the same time in events and _time  while importing the data getting the time difference what to write in time_prefix field    ... View more

Need to write a regex for  same as time and same as event given below in image    ... View more

How we can get the health status of the HF,UF and IHF which are connected to DS while using the rest am able to see the health for the MC ,CM, LM,DS, Deployer and IDX etc but not able to get the status health which is in Red Yellow green and not getting . Rest which am using is - | rest /services/server/health on MC am able to see health status of  MC ,CM, LM,DS, Deployer and IDX but not for forwarders also while am running the same query opening any of the HF U.I am able to see there health results. ... View more

Is there is any query to check like if there is any fixup pending and also it shows SF , RF and data is searchable  in the cluster master . We can check in cluster master U.I but without going there is there anywhere this log are store so that we can fetch. I need to created a query which shows the status of SF, RF and searchable in Cluster Master also if there are any fixup pending. ... View more

Need help for the below Query  index=na sourcetype=na:co state=down host_state_type="HARD" [| tstats prestats=f values(host) as host_name WHERE index=df AND host!=1* | eval host_name=lower(host_name) | mvexpand host_name ] | stats count as DownMins by host_name |sort - DownMins|head 25 | addcoltotals label=Total labelfield=host_name While am running the query for last 24 hours its showing results but when I reduced the time range to less than 24 hours it's not showing any output but previously this query is running fine. Also while I run the query like -  It shows me output for last 24 hours   - index=na sourcetype=na:co state=down host_state_type="HARD" while I search the same host in  - index= df  host="ooo" Am getting the results while combining both not getting results less than 24 hours  Also I can see in the backend those host are down but not showing in Splunk query  ... View more