Hi,  multiple Forwarders stops sending data for no reason for every 20 days , but when a restart is done, all starts sending normally. there are no warning or error logs in splunkd either. not sure what's causing the issue. This issue is happening on same forwarders every time.  ... View more

Hi,  I'm trying to get non matching id's from first search to second search.  eg:  i have 10 id's from first search and only 5 id's are matching to second, i need to display the other non matching id's from first search 1st search                                                                                            2nd search  ID      name   joined_date                             Cust_id           name        joined_date          last_date    100     a        01/01/2000                             100                     a               01/01/2000     12/01/2001 150     b        02/01/2000                              150                     b              02/01/2000     12/01/2002 200     c        03/01/2000                                200                    c               03/01/2000     11/01/2001 250     d        04/01/2000                               250                     d                04/01/2000     10/01/2001 300     e        05/01/2000                                300                    e                  05/01/2000    12/01/2005 350     f         05/01/2000 400     g        06/01/2000 450    h        06/01/2000 500     i        07/01/2000 550     j        08/01/2000          result set ID         name              joined_date 350       f                    05/01/2000 400       g                   06/01/2000 450       h                     06/01/2000 500       i                     07/01/2000 550       j                      08/01/2000 i have tried using NOT condition index=abced_dev business=finance  |dedup id | table ID name joined_date NOT [search index=xxxyz business=audit |dedup Cust_id |rename Cust_id as ID |table ID name joined_date] |table ID name joined_date Thanks ... View more

Hi,  I was trying to get the difference of 2nd and 3rd row and display it as 4th status value, below is my search  index = prod_e2 sourcetype=prod_csv type="n" | dedup order | stats count | eval status = "first" | append [search index=prod_e2 sourcetype=prod_csv type="n" and desc="2" |dedup order |stats count | eval status="submit" |table status count] | append [search (index= prod_e2 sourcetype=prod_csv type="n" and stat_desc="2" and order_num !="0" ) or (index = prod_e2 sourcetype=prod_csv) | dedup order | stats count | eval status = "created" | table status count] I was able to get it as  status        count first              20 submit        10 created       50 but I want it as  status                    count first                           20 submit                     10 created                    50 difference               40 ... View more

Hi Wanted to subract the subquery results from main query. i.e index=main source=/folder/abc.csv |table customername - [index=main source=/folder/xxx.csv |table name ] can this be achievable ? i want to get only the names which are not common from both the files. Thanks ... View more

Hi, I would like to extract a field from lookup data, can i use below search for extraction | inputlookup dataframedata.csv |regex "\s(?\A\w{1,2}+).gmail.com" i'm trying to extract only xxxxx as server from the below field Server_domain xxxxxxxxxxxx.gmail.com ... View more

Hi, I was trying to setup indexer cluster, but in the console its showing the replication factor and search factor or not met ? got the below error in Splunkd.log Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=5610983424, elapsed_ms=1 01-26-2019 07:43:28.260 +0000 WARN CacheManager - Unable to evict enough data. Evicted size=0 instead of size=5610983424 01-26-2019 07:43:29.261 +0000 INFO CacheManager - Eviction requested, bytes_needed=5610983424 partition of path=/opt/splunk/var/lib/splunk/audit/db 01-26-2019 07:43:29.261 +0000 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db ... View more

Hi, I'm trying to load a CSV file using the universal forwarder, and there are no headers in the CSV file. How can I give column names to those values in the file? Can I do that at props.conf? I don't want to use the extract field option... eg : file.csv as below values 1,2,3,4,5 6,7,8,9,10 11,12,13,14,15 ... View more

what are the possibilities of getting different results for same search ( there is no change in query and time) ? ... View more