Hi, I want to create app in my Search head(SH) in distributed environment,but i do not have the deployer setup. i have four SH ,so how to create app in SH without deployer? also i tried to create App in one of the SH but after restarting the app is getting deleted, any idea why is it so? If any other solutions kindly let me know ... View more

Hi, I want to setup an alert whenever SMTP server is stuck/hung i.e. when smtp is not sending alerts. My SMTP server gets stuck certain time and wont be sending any emails until we restart the server. so I want to setup an alert in splunk to notify me when the SMTP server is stuck. P.S when the SMTP server is stuck no logs are generated so there is no such specific error messages. so let me know if there is any way to setup an alert. thanks:) ... View more

HI, I have dashboard with 3 panels,when I click on panels it will scroll down and navigate to the details of that specific panel. ex : 1) cpu 2) memory 3) DB when I click on cpu it is taking me to cpu details in the same page,similarly when I click on memory it will take me to memory details. I want reject memory and DB details when I click on cpu and display only cpu details. I am not passing tokens here,i am using ID. below is the sample code of ID : <a class="pagelink_button nav" **id**="**CPU**"> any xml code or html code on how reject Other ID's and depend on only one ID? OR any xml code or any other way to implement this requirement? Thanks ... View more

Hi, I have installed a new Linux forwader but I am not able to see logs from this forwader. I have set the deploymentclient.conf and restarted the forwader couple of times . I don't see any logs from this forwader in internal index. I am getting the below error: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. my outputs.conf [tcpout] defaultGroup = HF_group [tcpout:HF_group] autoLBFrequency=60 server = myserver:9997 I have seen couple of links of enabling the listener port but coudnot fix my issue from that. P.S my forwader send the logs to Heavy forwader. Any solution to fix this issue? Thanks in advance:) ... View more

Hi, I have installed a new Linux forwader,but I am not able to see the logs from this forwader. I have configured deployments.conf,have restarted forwader a couple of times but still getting the below error and I don't see any logs in the internal index from tis forwader. P.S the forwader I installed will send the logs to Heavy forwader. *03-27-2020 07:59:16.055 -0700 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf* my output.conf [tcpout] defaultGroup = HF_group_1 [tcpout:HF_group_1] autoLBFrequency=20 server = myserver:9997 I have seen couple of links to enable the listener port,but could not fix my issue: thanks in advance:) ... View more

hi, I want to add a custom button in the dashboard for the following data can someone please help me on how to proceed with these as if new to this? EXAMPLE DATA: macro micro alpa When I click on macro button it should show me the following result: RESULT macro: atom electron similarly when I click on micro button it should give me only micro result and not macro: RESULT micro: neutron proton ... View more

i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply but when I am trying the same props.conf in the UI (add data) before indexing the data it is working. HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM E=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=* ,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP tried with below 2 props.conf. [sourcetype] EVENT_BREAKER_ENABLE=true EVENT_BREAKER=(|) [sourcetype] BREAK_ONLY_BEFORE = (|) I am using splunk 7.0 version ... View more