There is a request to provide the list of P1C alerts for  JMET cluster from Splunk we have provided the following query, but user wants only priority will be P1C | rest /servicesNS/-/-/saved/searches | table title, eai:acl.owner, search, actions, action.apple_alertaction * This query is giving all the alerts configured but we want only P1C alerts. Its urgent. ... View more

Show source is not loading for only one event, getting "Failed to find target event in final sorted event list. Cannot properly prune results" after loading ... View more

Selected fields in splunk UI are not getting saved, each time again we need to select the fields once logging again to splunk UI. ... View more

Splunk search query retrieves logs from the specified index, host, and sourcetype, filtering them based on various fields such as APPNAME, event, httpMethod, and loggerName. It then deduplicates the events based on the INTERFACE_NAME field and calculates the count of remaining unique events.   Splunk alert monitors the iSell application's request activity logs, specifically looking for cases where no data is processed within the last 30 minutes. If fewer than 2 unique events are found, the alert triggers once, notifying the appropriate parties.   From our end records are processed successfully and we provide the condition to trigger an INC count less than 2 we are getting more than one successful events even alert get triggering and getting INC Please check why we are getting false alert and suggest us index=*core host=* sourcetype=app_log APPNAME=iSell event=requestActivity httpMethod=POST loggerName="c.a.i.p.a.a.a.StreamingActor" | dedup INTERFACE_NAME| stats count ... View more

On splunk user is getting the following error:Could not load lookup=LOOKUP-pp_vms  but admin is not getting any such errors.   that look up file is not present also. What we need to do? ... View more

We have a Splunk Dashboard for our Team in Splunk  Cluster. Almost every report item is having exclamation symbol and contains the below message. The issue has been present for the past 1 month. Could you please help me in fixing the issue. Error Details: --------------------- *-199.corp.apple.com] Configuration initialization for /ngs/app/splunkp/mounted_bundles/peer_8089/*_SHC took longer than expected (1145ms) when dispatching a search with search ID remote_sh-*-13.corp.apple.com_2320431658__232041658__search__RMD578320bc0a7e9dada_1709881516.707_378AAA09-A2C2-4B63-B88A-50A6B29A67DF. This usually indicates problems with underlying storage performance." ... View more

Please let me know the correct data extraction?   index=* "Unknown message for StatusConsumer" topicId marshall | rex field=_raw "\"topicId\":\"(?<topicId>\d+)\"" | table topicId   Datas are not getting parsed after giving table name on splunk query. ... View more

my splunk query results are getting truncated when creating a table Is there any workaround to avoid this ?? index=gbi_* (AppName=*) | table SQL ... View more