Hi @Ruchi, Happy to help. Could you please accept the answer, so that this thread can be marked as closed. Thanks ... View more

You can run the below command under the /etc/auth folder or where your certificate is placed. openssl x509 -in server.pem -text -noout|grep -i CN With the information, you can find out the certificate is Splunk default certificate or third party certificate. Splunk uses the Splunk self signed certificate for the SSL communication by default. ... View more

Hi @Ruchi, in the case of third-party certificates, it will be the same except for the renewal part. You need to renew the certificate with your employer or from which third-party certificate you got. ... View more

Follow this answer to find out the renewal of the SSL certificate. https://community.splunk.com/t5/Security/How-do-I-renew-an-expired-Splunk-Certificate/m-p/389701 ... View more

If I understand the question correctly, you need to trigger the alert through your scripts. If this is the case, then you can add the alert action as "Run a Script" and give your script name in the field name. Then you need place the script in any of the location   $SPLUNK_HOME/bin/scripts or $SPLUNK_HOME/etc/<app>/bin/scripts. ... View more

Hi @SamHTexas, As per my knowledge, if the data is from the file, then you no need to worry about the queue, Splunk will read from where it stopped. However, if the data is not from the file and it is generated data, then you need to increase the queue size to make the storage available to catch all the data during the forwarder offline. ... View more

The data is time-dependent, so I cannot do as you explained in the first part. However, still I agree, as @richgalloway said, the Splunk team should arrange something regarding the price or the way to solve this problem. I posted here to see if anyone has any idea or anyone faced this scenario already. I will keep this question open for some time to see if any other response is coming and I will access his answer after some days. Thanks, @Funderburg78 for the suggestions. ... View more

Hi @Funderburg78, Thanks for answering this question. Whatever you said is 100% correct to find the culprit which one is causing the spike in the license usage. However, let's say the client is from a retail seller, and every month starting the sale is high and the logs are generated high and the remaining days in the month will not be high as explained in my question. The point I am trying to make is, there is no culprit who is causing the issue. The design of the application is like that, every month starting the usage is high, so the logs generated by the application are high. ... View more

Hi @bzam, I tried your query and it looks working for me. I took one of the fields from the summary index and replaced the bytes in your query, it worked both ways. Please check whether the bytes field is there in your summary index and also tried to step by step, like run the query until, you calculate the GB and see your fields section whether the GB variable is extracted or not, then you can apply the stats function on top of that. ... View more

Hi @aferns0804 , I understand 50% of your question, but I did not get what you are referring the result(stats) of the alert means? To implement the concept, you can use the drildown option for the respective panel to populate the token value and create a another panel which will use this token as input in the query. ... View more

Hi @sh254087  If you are running the below query in the dashboard, you can set the token in the dashboard. So, you can use the $token_a$ in your label where you want to display it. | rest /services/authentication/current-context splunk_server=local | where user = "admin" | table user ------------- <progress> <set token="token_a">$result.user$</set> </progress> ... View more

Looks like a connectivity problem between the forwarder and Deployment Server. Check the connection between both. ... View more

I have done few changes to solve the issue. IgnoreOlderthan=1d blacklist=filename.<yesterday>.txt (Because all the older files are in the same folder structure) Restarted the forwarder exactly at 12o clock Even though few lines of data got re-indexed, however, it is around 10 to 20 lines only which were acceptable. ... View more

Thanks @manjunathmeti  for answering the question.  However, if we put crcSalt=<SOURCE>, then the older files are getting re-indexed because the files are in same folder. Example: /app/folderA/locationA/filename_yyyy-mm-dd.txt /app/folderB/locationB/filename_yyyy-mm-dd.txt So if we put crcsalt in any of the file, under the location all the files are getting re-indexed. If we put ignoreOlderthan=1d, still the yesterday file is getting re-indexed. ... View more