Thank you so much @PickleRick  it very useful information. ... View more

Hi @PickleRick  Actually in phase-1 we are upgrading RHEL version (6.10 to 9.x--- just same OS but we are upgrading the version) the RHEL upgrade we are planning in new separate server from the scratch and after  RHEL upgrade,in phase-2 we have a splunk upgrade(8.2 to 9.x) . So in phase-1 we are installing  existed splunk version (8..2)  in new server and we need data migration from existed server to new server.Please could you help on this... Thank You in advance.. ... View more

Hi @PickleRick , firstly we planning to migrate data from existing server new server then afterwards splunk upgrade so here i wanted to know the steps  how to migrate data from my existing server to new server..within the server we know but now its new server so asking you how to migrate data.and the second  thing the installation and upgrade my team will see that and here i need only how to migrate my data. so kindly please help on this ... View more

hi @PaulPanther  This is the screen shot of Job --> Inspect Job. Please I need help on this asap.   ... View more

Hi @PaulPanther I believe I have access     ... View more

Hi @PaulPanther Still same I'm Facing Issue How can check weather I have access to the summary index. could you please help me. ... View more

  Hi @PaulPanther this is screen shot after adding testmode=true   ... View more

@ITWhisperer  Actually this is my query index=fwdl-meter-batching-agent-logs earliest=-7d@h-5d     | rex field=_raw ""requestId"(?<x>[\w\W]+?)]" max_match=0     | table internalFWDLRequestId x     | mvexpand x     | rex field=x "\"commsHubId\"\s+:\s+(?<CH_ID>\d+)" max_match=0     | rex field=x "^\" : \"(?<suRequestId>.+?)\""     | mvexpand CH_ID     | rename internalFWDLRequestId as requestId     | eval x=requestId."-".CH_ID     | fields x suRequestId ... View more

@ITWhisperer  Its not working  which you have shared in my query    ... View more

Hi @efavreau @ITWhisperer , Actually present I'm using this regex in query  | rex field=_raw ""requestId"(?<x>[\w\W]+?)]" My raw data is json format  "batchId" : "63361",   "internalFWDLRequestId" : "70-B3-D5-1F-30-5F-30-00:70-B3-D5-1F-30-00-A0-03:519633036",   "initialJobId" : 3860464,   "batchCreationDate" : 1709203012824,   "batchSubmissionDate" : 1709293013333,   "allowMultipleRequests" : true,   "abortedCountForDuplicateRepId" : 0,   "abortedDuplicatesJobId" : null,   "image" : {     "approvedFirmwareVersionId" : "00070400",     "fileName" : "00070400",     "imageByteCount" : 663191,     "mfcImageThumbprint" : "663125_675428228_vQhOAh27O+KHxkpO/Qrq0g=="   },   "serviceUserRequests" : [ {     "requestId" : "70-B3-D5-1F-30-5F-30-00:70-B3-D5-1F-30-00-A0-03:519633036",     "requestDate" : 1709203013315,     "imageCRC" : 2291340038,     "numberOfCommsHubs" : 3,     "deliveryPoints" : [ {       "commsHubId" : 101388585,       "endpointId" : "00-1D-24-02-01-0B-11-8E"     }, {       "commsHubId" : 101762268,       "endpointId" : "00-1D-24-02-01-0A-D0-81"     }, {       "commsHubId" : 102016271,       "endpointId" : "00-1D-24-02-01-0A-CF-75"     } ]   } ],   "endpointType" : 1 ... View more

Hi @isoutamo ,   Thank you. I will check.  Moreover, it not a clustered Env we have only 2 indexers,1 license master and 1 search head.  And I have attached the file, please could explain this paths, retention policies and bucket configurations from the screen shot.   thanks, in advance.  ... View more

Hi @richgalloway  Please could explain this paths, retention policies and bucket configurations from the screen shot.     Thanks, Praseeda ... View more

Hi @richgalloway,    Hi @richgallowayrichgalloway,  Actually, when I check in Setting-->Monitoring console--->Indexing--->Indexes and volumes---->Index Details: Instance but here in buckets I didn't see anything for the same I'm attaching screen shot.  Please could you explain once?    ... View more

Hi @PickleRick ; I have used dbinspect command  but here I need sourcetype and even the total count and size of command_type="METER_ALERT" and NON "METER_ALERT" separately . Query :   index=service_audit sourcetype=SMWAN command_type !="METER_ALERT" |eval size=len(_raw) | eval raw_len_KB= size/1024 | eval raw_len_MB = size/1024/1024 | eval raw_len_GB = size/1024/1024/1024 | table size,raw_len_KB,raw_len_MB ,raw_len_GB,index | stats count sum(size) as Bytes sum(raw_len_KB) as KB sum(raw_len_MB) as MB sum(raw_len_GB) as GB by index       ... View more

I will check come back  thank you so much  ... View more

Hi , I have checked indexex.conf but here I did not find Retention option like  "frozenTimePeriodInSecs". then it means default is 6years . Even when I'm giving 6 yr periods I did not see the data why ? ... View more

Yes, For shorter periods it is working fine. How can I check retention time grater than seven years  and it is not a summary index . Please could you help on this ... View more