I even opened a support case with splunk.  They told me to read the development guide.  apparently this error is a mystery to anyone who sees it.  ... View more

And what is the question? As you generated CSR, you should have already generated a key for which you were creating the CSR so you must have it somewhere. Otherwise the cert you got is useless because it is paired to your private key. ... View more

Also take into account that displaying PDFs is not a Splunk interface functionality but rather something that might be (or not, depending on the version) implemented on the browser side. And might probably be disabled in some browsers. ... View more

This answer offers a CLI method for changing the order for all users: https://community.splunk.com/t5/Knowledge-Management/How-do-I-change-the-order-of-apps-in-the-dropdown-menubar/td-p/452435 . I have not tested it myself. ... View more

Thanks for the response, and inputs/insights, Luke. These are noted. Appreciate your time for getting back as well. ... View more

You can restrict a user to have additional limitations to his/her search. https://docs.splunk.com/Documentation/Splunk/8.2.4/Security/Addandeditroles#Specify_default_app_and_search-related_limits_for_a_role But as far as I remember it's configured on a per-user basis, you can't set it to differentiate between  indexes. ... View more

This explains it. Thanks for this! ... View more

Thanks @to4kawa . That may work but what I am trying to achieve is that a plain search using the index and sourcetype at search time will return masked data accdg. to the rule set. Thus using a calculated field for _raw. Thanks still for the suggestion. ... View more

Hi Ariel, i'm getting same issue, did you get it solved? if yes what was the resolution? ... View more

I broke up the response into two parts since there are two questions in the post: Why this isn't considered a time-out? The input got a response from the HTTP server which is why this isn't considered a timeout. Let me explain. The timed_out field indicates that the TCP or HTTP connection timed out by not responding with any data. In this case, the input successfully got an HTTP response with a response code of 504. The 504 response code itself indicates that though the HTTP server responded, it could not connect to some other system for some reason. Why is the HTTP/504 error happening? You will need to do some debugging to figure this out. Some things to consider trying are: Try a different URL on the same site to see if it is limited to the one URL See if the error is transient (goes away and comes back) Looking at the web-server logs if you have access to them Pulling packet captures to see the HTTP connection in case it helps ... View more

Hi @cusello. Yes, Load balancing has been setup in our forwarders. Thanks again, Ariel ... View more

@inventsekar, if you are seeking further details or are unsure of the answer provided it is better to add a comment rather than Answer, so that the question remains visible to other Splunkers for answering. Refer to Splunk Answers guideline on the same: http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Questions#How_to_answer_a_question ... View more

The problem here is that your logging source is very poorly behaved; no logger should ever rotate files in the midst of an event. In any case, there is nothing that Splunk can do about it so fixing it upstream is your only option . ... View more

So, are you ok now? ... View more

what version of splunk are you currently running? if you are on 6.6, i would recommend the new Trellis feature for this. | makeresults |eval data="_time=1498217650,component=A,status=running,no=10 _time=1498217651,component=A,status=running,no=20 _time=1498217652,component=A,status=offline,no=10 _time=1498217653,component=A,status=online,no=30 _time=1498217650,component=B,status=running,no=20 _time=1498217651,component=B,status=offline,no=40 _time=1498217652,component=B,status=offline,no=10 _time=1498217653,component=B,status=running,no=40"|makemv data |mvexpand data|eval _raw=data|kv|eval _time=time|stats values(no) as no by _time component status|eval{status}=no|fields - status - no you can split each component into its own chart with the same query. Splunk does not currently have a way, that I know of, to allow for multi-level x-axis, like Excel does, and the trellis feature is a close second. ... View more

Hi, in my case label is dinamically because contain also the %, for example: 30,1% Completed 23% InProgress But these values are dinamic so change everytime, how we can manage this scenario? ... View more

Hello Ariel, delivering the function / functionality won't be a problem with the predict command or maybe even the ML app. The question would be if the predication has any value. Do you have some more background info on the ticket data? (eg. are these changes or incidents, have there been changes in the infrastructure or services during the past years etc.) ... View more

Solution is here, https://answers.splunk.com/answering/823957/view.html ... View more

Right on the first part, lower values than 95 means there's a lower likelihood the actual value, when you finally measure it, will be within that range. Let's talk a bit about the 100% confidence interval. What would that say? "I can say with 100% confidence that the next value of this sequence of numbers will be between X and Y." What would you pick for X and Y to get that 100% confidence interval? Not really, really likely to be, but actually "WILL BE" within that range, even if I have broken equipment or the Russians invade Poland or ... or ...? For a count such as we we using as an example, I could only pick X to be zero (counts can't be negative) and Y to be positive infinity. You'd have to pick such a large range because a 100% confidence interval is a guarantee that the next, unknown value will fall between X and Y. Regardless of what this particular sequence did in the past, you really are only guessing what it'll do next time and if you had to make a guarantee... Now, in real life it won't be positive infinity, for sure. In my case pretend case (the first one, with the fairly consistent data about 100) you may know that the equipment isn't rated to handle more than 10,000 events per minute. In that case you could "kind of" say you had a 100% confidence interval of zero to 20,000 (because you never know and vendors lie). But still, I'm sure you get the point that it's not really very helpful because it has to cover every possible value that measurement could take. So 100% is not achievable. Or maybe a better way to describe is is 100% is achievable but tells you nothing. You can get fairly close on some data, but real life data is usually more messy. Compare that sort of guarantee to "75% of the time the value will fall between 98 and 103". Or "95% of the time the value will fall between 93 and 108". Or even "I'm nearly certain - 99.9% confident - that the next value will fall between 60 and 141." How's the old joke go? The only things you can say will happen with 100% certainty are death and taxes. 🙂 ... View more