thank you, can you please let me know the python script to upload the diag file to splunk support  ... View more

we are have multiple splunk cluster and will need to generate a diag file everytime for search head or indexer..  so need to automat the process of generating the diage and upload in splunk support case automatically.  i have script to generate a file and enter the case but spplunk support is will need api or some connection to login and search the case and upload the diag.    ... View more

thank you for the update, all the search head having same pem file.  ... View more

I have tried to get the index not used used any KO, but not getting all the details.  | rest /services/data/indexes | fields index | eval index=1 [index=_audit| stats count as accessed by index, search ] | stats sum(accessed) as accessed, values(index) as index by  | fillnull accessed value=0 | where index=1 AND accessed=0 Total Index Index Not used in Any Knowledge Object Index has 0 data last 90 days 100 25 10 ... View more

I am listing the index name using rest query and then checking those index name with audit or internal to to find if how many index used, sourcetype used, and HOW Many index not used in splunk.  Also i need to identify which indexes and sourcetypes have not received any data for a period exceeding 90 days. ... View more

the query is not getting expected result,  I need to get the list of index which is not used by anyone ... View more

the query is not getting expected result,  i was runining for last 90 days but didnt get the result.    ... View more

Thank you for your response, but your query is providing list of dashboard accessed and i am looking for number of unused/not accessed by anyone.  ... View more

thank you for your response, I have tried your query but not getting the user not logged in for last 7 days 30d or 90d. it showing total 0,i need to show by selecting the time range it should automatically show the result which user not logged into splunk web UI.  For example we have 100 account in user list, only 10 users are actively login in, remaining user need to identify the when they last logged into splunk.  ... View more

thank you for your response, I have tried your query but not getting the user not logged in for last 7 days 30d or 90d. By selecting the time range it should automatically show the result which user not logged into splunk web UI.  For example we have 100 account in user list, only 10 users are actively login in, remaining user need to identify the when they last logged into splunk.  ... View more

index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage | stats sum(b) as bytes by st , idx | eval GB=round(bytes/(1024*1024*1024),6) | table st, idx, GB | sort -GB | eventstats sum(GB) as total | eval Percentage=round((GB/total)*100,6) | rename st as SourceType | rename idx as Index | stats list(SourceType) as "Source-Type", list(GB) as GB by Index | addtotals col=t row=f labelfield=Index label="Overall Total" ... View more

Please find teh below sample values Index Source-Type GB aws_vpcflow aws:vpcflow 10 aws:cloudwatchlogs:vpcflow 20 windows windows:fluentd 30 windows 40 WinEventLog:Security 50 cloud  cloud_watch 60 aws_cloud 70 ... View more

If i use the  | addtotals col=t row=f labelfield=Index label="Overall Total" , I am getting incorrect total result , becuase one index and multiple sourcetype values are there.  ... View more

Please let me know if you get an answer ... View more

I am looking for custom index in splunk not audit index used in choice.  I have extracted the idx st using rex in 3rd lineof my query, so i need to select either index=aws or sourcetype=aws;cloud in checkbox <form theme="light"> <label>Logical Test</label> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="index"> <label>Index</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>index_name</fieldForLabel> <fieldForValue>index_name</fieldForValue> <search> <query>| REST /services/data/indexes |dedup title | rename title as index_name | table "index_name"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <delimiter>","</delimiter> <initialValue>*</initialValue> </input> <input type="multiselect" token="sourcetype_name"> <label>Sourcetype</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>sourcetype_name</fieldForLabel> <fieldForValue>sourcetype_name</fieldForValue> <search> <query>| tstats count WHERE index IN ("$index$") by sourcetype | rename sourcetype as sourcetype_name</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <delimiter>","</delimiter> <initialValue>*</initialValue> </input> <input type="checkbox" token="field3"> <label>Logical</label> <choice value="index_name=index AND sourcetype_name=sourcetype">Index AND Sourcetype</choice> <choice value="index_name=index OR sourcetype_name=sourcetype">Index OR Sourcetype</choice> <delimiter> </delimiter> </input> <input type="time" token="field1"> <label>Time</label> <default> <earliest>-4h@m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Search</title> <table> <search> <progress> <set token="adhoc"></set> </progress> <query>index=_audit sourcetype=audittrail info!=granted provenance="UI:Search" | rex field=_raw "search=\'(?&lt;search&gt;.*)\'," | rex field=search max_match=0 "[\w^]*index=\s*\"*(?&lt;index_name&gt;[^\s\"]+)" | rex field=search max_match=0 "sourcetype=[\"]?(?&lt;sourcetype_name&gt;[\S]+)" | where isnotnull(search) | search $field3$ | rename info as Completion | table _time index_name sourcetype_name search, user | rename user as "accessed by"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">none</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="time_ago(seconds)"> <option name="precision">0</option> </format> <format type="number" field="seconds_ago"> <option name="precision">0</option> </format> <format type="number" field="exec_time"> <option name="precision">0</option> </format> <format type="number" field="search_lt"> <option name="precision">0</option> </format> <format type="number" field="search_et"> <option name="precision">0</option> <option name="useThousandSeparators">false</option> </format> </table> </panel> </row> </form>   ... View more

<form theme="light"> <label>Logical Test</label> <fieldset submitButton="true" autoRun="false"> <input type="checkbox" token="command" searchWhenChanged="false"> <label>Logically OR'ed Search Command</label> <default>*</default> <initialValue>*</initialValue> <choice value="*">Index</choice> <choice value="**">SourceType</choice> <choice value="***">Index OR Sourcetype</choice> </input> <input type="time" token="field1"> <label>Time</label> <default> <earliest>-4h@m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Search</title> <table> <search> <progress> <set token="adhoc"></set> </progress> <query>index=_audit sourcetype=audittrail info!=granted | rex field=_raw "search=\'(?&lt;search&gt;.*)\'," | rex field=search max_match=0 "[\w^]*index=\s*\"*(?&lt;idx&gt;[^\s\"]+)" | rex field=search max_match=0 "sourcetype=[\"]?(?&lt;st&gt;[\S]+)" | table search user idx st</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">none</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="time_ago(seconds)"> <option name="precision">0</option> </format> <format type="number" field="seconds_ago"> <option name="precision">0</option> </format> <format type="number" field="exec_time"> <option name="precision">0</option> </format> <format type="number" field="search_lt"> <option name="precision">0</option> </format> <format type="number" field="search_et"> <option name="precision">0</option> <option name="useThousandSeparators">false</option> </format> </table> </panel> </row> </form> ... View more

Yes its part of my dashboard, for example if i select checkbox or radio button ( logical AND or Logical OR) will show the result accordingly in panel either is simple search or any other panels.  could you please give me example search to define the token ... View more

Could you please give me some example because i need to use this into ad-hoc search and saved search ... View more