You can serch using following searches: | tstats values(splunk_server) as Host, values(clientip) as IP from _internal where index=_internal sourcetype=splunkd by host or  index=_internal sourcetype=splunkd | stats values(clientip) as IP by host Enjoy,   ... View more

Hello @splunker011  Try use this code: <table> <title>TABLESPACE_FREESPACE</title> <search> <query> index="database" source="tables" | eval BYTES_FREE = replace(BYTES_FREE, ",", "") | eval BYTES_USED = replace(BYTES_USED, ",", "") | eval GB_USED = BYTES_USED / (1024 * 1024 * 1024) | eval GB_FREE = BYTES_FREE / (1024 * 1024 * 1024) | eval GB_USED = floor(GB_USED * 100) / 100 | eval GB_FREE = floor(GB_FREE * 100) / 100 | eval CALCULATED_PERCENT_FREE = (GB_FREE / (GB_USED + GB_FREE)) * 100 | eval CALCULATED_PERCENT_FREE = floor(CALCULATED_PERCENT_FREE * 10) / 10 | rename TABLESPACE_NAME as "Tablespace", GB_USED as "Used Space (Gb)", GB_FREE as "Free Space (Gb)", PERCENT_FREE as "Free Space (%)" | table "Tablespace" "Used Space (Gb)" "Free Space (Gb)" "Free Space (%)" </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">21</option> <option name="drilldown">none</option> <option name="wrap">false</option> <!-- Use rangeMap to define colors based on "Free Space (%)" --> <format type="color" field="Free Space (%)"> <rangeMap> <range min="0" max="20" color="#FF0000"/> <!-- Red for low free space --> <range min="20" max="50" color="#FFA500"/> <!-- Orange for medium --> <range min="50" max="100" color="#00FF00"/> <!-- Green for high free space --> </rangeMap> </format> </table>   Have a nice day, ... View more

Hello @stevensk  To be able to see the source IP of HEC forwarders you need to enable logging on HEC's input.conf file: [http] enableSplunkdSidechannel = true And then run search to see logs containing specific token: index=_internal sourcetype=splunkd "token=" To filter by source IP you can run for example this search: index=_internal sourcetype=splunkd "token=" | rex "sourceIp=(?<source_ip>\d+\.\d+\.\d+\.\d+)" | stats count by source_ip I hope this will help you. Have a nice day,       ... View more

Hello @chenfan  You cannot do direct upgrade from 7.2.x to 9.2.x. You have to go throught version levels as @gcusello mentioned in previous post.  Have a nice day,   ... View more

Hello Maybe you need to edit /opt/splunk/etc/system/local/web.conf adding the stanza: splunkdConnectionTimeout = 120 More HERE. ... View more

Hello Can you, please, explain more what you have and what you try to achieve?  I really don't understand what your problem is. Thank you, ... View more

Have look at this DOCUMENTATION PAGE. Debugging logs should be send into _internal index. Look at that index.   ... View more

Are you talking about this APP? If so, I don't think is application has it's own debugging log file.   ... View more

You are absolutely right. Splunk ran under root account. I have changed it already, but it didn't help. Normal universal forwarders works great, only Splunk servers don't change configuration. But I will handle it using ../local/ files as you suggested. Thank you,   ... View more

Hello Thank you for your answer. I tried your command and I have got: root@MSVMSLMCLM01:/opt/splunk/bin# ./splunk btool alert_actions list --debug | grep allowed /opt/splunk/etc/apps/setSplunkCommonConfig/default/alert_actions.conf allowedDomainList = domain.sk root@MSVMSLMCLM01:/opt/splunk/bin# ./splunk btool alert_actions list --debug | grep from /opt/splunk/etc/apps/setSplunkCommonConfig/default/alert_actions.conf from = splunk@domain.sk So this looks like settings are used from correct file, file from pushed application. But when I check web on this machine, those values are empty: Any idea?   ... View more

I wanted to change "Allowed Domains" field under Server Settings -> Email settings. When I do it using website I get following log in audit.log: "changes":[{"stanza":"email","properties":[{"name":"allowedDomainList","new_value":"domain1.sk","old_value":""}, When new application is installed I can see following log line saying that value is changing: "changes":[{"stanza":"email","properties":[{"name":"allowedDomainList","new_value":"domain2.sk","old_value":""}, But difference is, that if value is changed using deployment application, I don't see accurate change on website - Allowed Domains is empty.   How would you do this?   ... View more

Restart didn't help.   ... View more

Nope. Is it neccesary to restart splunkd? ... View more