@htidore  1. Try clearing all *.splunk.com cookies 2. Since it works from your office network but not from your desktop, there might be a network-related issue. Check if there are any firewall or proxy settings on your desktop that might be blocking access to Splunk. If possible, try using a VPN to connect to your office network and see if that resolves the issue. This can help determine if the problem is related to your network configuration. ... View more

Introspection endpoint descriptions - Splunk Documentation normalized_load_avg_1min Normalized load average of runnable_process_count across all cores (cumulative_load_avg / number_of_cores). This value is not reliable for a VM guest. ... View more

I am also facing the same problem on newly setup VM's running Windows 2019.  Tried all the options suggested here but no success.  ... View more

We cannot change the config at UF. ... View more

If you had the meta field configured correctly on your search head, you should not see a difference. :: is forcing to treat it as an indexed field, regardless of setting it up correctly in fields.conf. Btw, the syntax in your inputs.conf should also use :: instead of =, but maybe both is possible. Have a look at this discussion: https://answers.splunk.com/answers/389567/why-is-a-search-for-fields-added-with-meta-in-inpu.html which I found when I was having issues with :: vs =. Hth, Kai. ... View more

Hi htidore! Glad to see you using add data wizard. It is a very useful way to ensure you build your sourcetypes right! As the warning explicitly advises, data preview is skipped for directories. It has been this way as long as I can remember. It is not an issue, it is expected behavior. It cannot traverse multiple directories/deal with multiple files at once. You can still build the input this way, just can't test your props. If you are trying to use it to build props, the best way around it is to start the data wiz as if you are working with a single file in the dir, navigate to a single file, set up the props the way you want, then use the "copy to clipboard" option to save the props settings you need, then cancel out of the wizard. You can then go back thru the wizard to enable the input if you need to, after you put your props in the correct app. ... View more

I am having the same problem but I don't know how to get chat id of a channel. Anyone can help me? ... View more

More details on how to managed logs for _internal . The _internal index are populated by the following stanzas: $SPLUNK_HOME/etc/default/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk] [monitor://$SPLUNK_HOME/etc/splunk.version] $SPLUNK_HOME/apps/SplunkUniversalForwarder/default/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] If we want to forward the logs only to "prod-group" then create the following in $SPLUNK_HOME/etc/system/local/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/etc/splunk.version] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] _TCP_ROUTING = prod-group ... View more

This is what I do in order to put two panels into one panel. There are two sections in a single panel section: single and chart. <form> <label>My Dashboard</label> <fieldset submitButton="false" autoRun="false"> <input type="time" token="field1"> ... </input> <input type="dropdown" token="field2"> ... </input> ... </fieldset> <row> <panel> <title>Water Level by Time and Sensor</title> <single> <title>Active Sensors</title> <search> ... </search> </single> <chart> <title>Sensor Level</title> <search> ... </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> ... </chart> </panel> </row> </form> ... View more

Thanks for this additional investigation hint. Helped a lot in my case. ... View more