An answer to this question would actually be fantastic. ... View more

Hey,  I suggest those videos on Youtube. You can follow the steps for the installation and u have also many examples to use correctly eventgen :  https://www.youtube.com/watch?v=WNk6u04TrtU&t=2796s&ab_channel=Splunk%26MachineLearning  https://www.youtube.com/watch?v=9N5RHvLiM0o&ab_channel=Splunk%26MachineLearninghttps://www.youtube.com/watch?v=WNk6u04TrtU&t=2796s&ab_channel=Splunk%26MachineLearning He is a good guy. Hope it' will help u. Good luck. ... View more

Never use the break_* settings. Try this: [bash_history] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+[\s#]*) TIME_PREFIX = ^ TIME_FORMAT = %s MAX_TIMESTAMP_LOOKAHEAD = 10 But that is probably not your problem. If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events. ... View more

Hi @jarizeloyola, Yes we do have GUI monitoring console. We don't have any access to GUI of license master. In GUI monitoring console, when we see disk usage - it shows 409 GB around and when we see size of indexes for today 390GB. and there's no change in config files ans still we can see that disk usage is increasing day by day 1 to 2 GB while size of indexes remains same almost. Could you help here and let me know what would be issue? ... View more

Hello, I mean the defaultGroup for syslog stanza. Looking into the Splunk docs, it seems this config is mandatory, and my tests agree with that. ... View more

Unfortunately, I can't copy the output of the btool command because it is too big and can't attach a file due to a lack of point for karma. Probably, you want to see particular strings? ... View more

Im not sure if I parsed your question correctly but based from what I understand you want to get the 2 latest events and concat it with a string. Based from your given example your log is in key/field=value form so that is automatically extracted . If you want to get the latest values it is better to use stats, its a lot faster and efficient instead of using sort which is too intensive , sorting should always be in the last. index=MY_INDEX sourcetype=my:source stats latest | stats latest(foo1) as foo1 latest(foo2) as foo2 | eval NEED1="new_".foo1 | eval NEED2="new_".foo2 | table NEED1 NEED2 Just incase you need a rex |rex field=_raw "fo(\w|\w\d+)\=(?<value>[a-z0-9].*)" ... View more

before stats , if Date is, the problem is stats . if Date isn't, the problem is strptime . but, I think no need strptime ... View more

it is just a sample , you can run it in any of the shc member or to the MC. you should be an admin or have the right privilege to get the result. | rest "/servicesNS/-/-/admin/savedsearch/" splunk_server="*" ... View more

Thank You @jimodonald .One last question what would be the default hot bucket setting when an index is created .Below is the index setting we have and what is the setting should we change to make the hot bucket 30 days [aws_abc] coldPath = $SPLUNK_DB/aws_abc/colddb homePath = $SPLUNK_DB/aws_abc/db thawedPath = $SPLUNK_DB/aws_abc/thawedb repFactor=auto frozenTimePeriodInSecs = 31536000 ... View more

FYI, I used the format visualization option which populated the proper code into the panel, then since the format menu only allowed ranges, I used your code to modify it to a single value. Here's the result: <row> <panel> <single> <title># of Systems</title> <search> <query>sourcetype=prod source=*peek.log config_section_stats | stats latest(_time) as latest_log_time, latest(model_time) as latest_model_time by case, source, hostname | convert ctime(latest_log_time) | stats dc(case) as NUM_LINES</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="rangeColors">["0xffffff","0xdc4e41"]</option> <option name="rangeValues">[44]</option> <option name="useColors">1</option> </single> </panel> </row> ... View more

Hi @jarizeloyola, thank you very much, for you help! it's a liitation!. Ciao and next time. Giuseppe ... View more

Missing or Truncated? By default Splunk default maximum line length is 10000, in bytes. If your event is more than the default value you can increase the TRUNCATE value in props.conf but never ever set it to 0. Make sure that you set properly the props.conf of the sourcetype of that data. - DATETIME_CONFIG - TIME_PREFIX - TIME_FORMAT - MAX_TIMESTAMP_LOOKAHEAD - TZ - LINE_BREAKER - SHOULD_LINEMERGE Check splunkd.log for messages such as "AggregatorMiningProcessor" to know more what's happening ... View more

Thank both of you for your suggested solutions! @adonio Good idea, thank you, I will test this with eval in the props.conf! @jarizeloyola Thanks! I am using ingest_eval for another source which timestamp can only be found in the filename, and it works great! However, I see splunkd timestamp errors for that source, so I have to check if inges_eval works in a way there will still have timestamp issues generated even if OK, or if it is something else! ... View more