Please I need help fixing this search below. Will appreciate the help. When I run the search I don't see the results I want the numerator for this to be "device Last Seen (q_last_seen OR cs_last_seen OR Last_Status_Time) within one to seven days AND agent has connected (last seen) in one to seven days OR device last seen (q_last_seen OR cs_last_seen OR Last_Status_Time) within eight to fifteen days AND agent connected (last seen) in eight to fifteen days. The denominator is "Total Active Devices     index=summary sourcetype=*_*station_* source="*workstation compliance summary" hostname!="*.corp" (dv_install_status IN ("In use", "In stock") OR ds="J*" OR (seen_by_cmdb="n/a" AND ds!="J*")) AND (seen_by_cs="Yes" OR seen_by_q="Yes" OR seen_by_sccm_status="Yes") AND (os=windows OR os=mac) | eval *_host =upper(*_host) | stats latest(os) as os latest(Last_Status_time) As Last_Status_Time by *_host | eventstats count(eval(os="WINDOWS")) AS scope_windows_total_active_devices count(eval(os="MAC")) AS scope_mac_total_active_devices count as scope_total_active_devices | eval device Last Seen=case(Last_Status_Time>=relative_time(now(), "-7d@d"), "1-7 days", Last_Status_Time>=relative_time(now(), "-15d@d") AND Last_Status_Time<relative_time(now(), "-7d"), "8-15 days") | eval *_host=upper(replace(DeviceName, "\..*$", "")) join type=inner *_host [ search index="its-*-*tec-app" sourcetype="*:*:agent:reports" source="D:\\*eData\\*Agent_*.csv" earliest=-1d latest=-1m | rename "Machine Name" as *_host | eval *_host = upper(*_host) | stats latest(IP) as IP latest(Version) as Version_*, latest("Last Update Received") as last_update_recieved by *_host] | stats count(eval(os="WINDOWS")) AS windows_total_active_devices count(eval(os="MAC")) AS mac_total_active_devices count as total_active_devices by scope_total_active_devices, scope_windows_total_active_devices, scope_mac_total_active_devices | eval completness = round(total_active_devices/scope_total_active_devices * 100, 2) | eval win_completness = round(windows_total_active_devices/scope_windows_total_active_devices * 100, 2) | eval mac_completness = round(mac_total_active_devices/scope_mac_total_active_devices * 100, 2) | eval win_incompletness = scope_windows_total_active_devices - windows_total_active_devices | eval win_incompletness_perc = round(win_incompletness/scope_windows_total_active_devices * 100, 2) | eval mac_incompletness = scope_mac_total_active_devices - mac_total_active_devices | eval mac_incompletness_perc = round(mac_incompletness/scope_mac_total_active_devices * 100, 2) ... View more

Can someone help me optimize this search so the results on the search and dashboard panel should be the same. The search powers the dashboard, but when the search is run the result is always different from the dashboard "| inputlookup workstation* where hostname!="*.corp" (dv_install_status IN ("In use", "In stock") OR ds="dal" OR (seen_by_obt="n/a" AND ds!="dal")) AND (seen_by_cs="Yes" OR seen_by_q="Yes" OR seen_by_sccm_status="Yes") AND (os="Windows" OR os="WINDOWS") | eventstats count as scope_count | join type=inner nt_host [ | search index="maj_p" OnboardingStatus=Onboarded OSPlatform=windows1* | stats latest(OnboardingStatus) as OnboardingStatus, latest(SensorHealthState) as SensorHealthState, latest(OSPlatform) as OSPlatform, latest(ClientVersion) as ClientVersion, latest(_time) as Def_Lastseen by DeviceName | eval Week_breakdown=case(Def_Lastseen>=relative_time(now(), "-7d@d"), "1-7 days", Def_Lastseen>=relative_time(now(), "-15d@d") AND Def_Lastseen<relative_time(now(), "-7d"), "8-15 days") | eval nt_host=upper(replace(DeviceName, "\..*$", ""))] | search OnboardingStatus=* | stats count as agent_count by scope_count | eval missing_agents = scope_count - agent_count | eval incompleteness = round((missing_agents/scope_count) * 100, 2) | eval completeness = round((agent_count/scope_count) * 100, 2)" ... View more

After upgrading from 10.2 to 10.4.1on my windows standalone  kvstore failed. Below is the message C:\Program Files\Splunk\bin>splunk show kvstore-status --verbose WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details. This member: backupRestoreStatus : Ready disabled : 0 featureCompatibilityVersion : An error occurred during the last operation ('getParameter', domain: '15', code: '13053'): No suitable servers found: `serverSelectionTimeoutMS` expired: [Failed to connect to target host: 127.0.0.1:8191]. Topology type: ReplicaSetNoPrimary guid : F1476FDB-216E-4F39-AC0E-9112CC38CC5F migrationStatus : NotStarted port : 8191 standalone : 1 status : failed storageEngine : wiredTiger versionUpgradeInProgress : 0   ... View more