That's interesting and a little bit odd, because the docs don't really make it clear that these are available to the running search because if you take the metadata tokens and make a search like this | makeresults | fields - _time | eval Name_Of_Search="$name$" | eval a="$action.email.hostname$" | eval b="$action.email.priority$" | eval c="$alert.expires$" | eval d="$alert.severity$" | eval e="$app$" | eval f="$cron_schedule$" | eval g="$description$" | eval h="$name$" | eval i="$next_scheduled_time$" | eval j="$owner$" | eval k="$results_link$" | eval m="$trigger_date$" | eval n="$trigger_time$" | eval o="$type$" | eval p="$view_link$" | transpose 0 and schedule the search, the output is this column row 1 Name_Of_Search SS_TEST a $action.email.hostname$ b $action.email.priority$ c 24h d 3 e $app$ f * * * * * g Saved Search Description h SS_TEST i $next_scheduled_time$ j $owner$ k $results_link$ m $trigger_date$ n $trigger_time$ o $type$ p $view_link$ indicating that not all of these metadata tokens are available ($search$ does work but breaks the running search do I didn't include it) Still my use case was always getting hold of name. ... View more

In my case, I forgot to enable listening on my indexers. (You'll need to do this on any heavy forwarders forwarders as well).  /opt/splunk/bin/splunk enable listen 9997 ... View more

This  eval durations = tostring(durAsSec, "duration") gives to you also days, hours and minutes. Just select those from that string. ... View more

Hi, You might have got the result i am replying so that it can help others  as you are using sendemail command and you need Contact field do the following ...|rename Contact as _Contact |sendemail to=$result._Contact$ subject=subject sendresults=true format=table  while sending mail splunk will ignore _Contatct field as it has underscore(_) Hope this helps Happy Splunking  🙂 ... View more

The default setting for the inputs.conf for the UF is a wildcard.  Change this to the default group in the local inputs.conf to override the setting. Pulled from the default inputs.conf for the UF: [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]  _TCP_ROUTING = * index = _internal     [monitor://$SPLUNK_HOME\var\log\splunk\metrics.log]  _TCP_ROUTING = * index = _internal  Add it in the local inputs.conf  and change it to what ever the default group is on the outputs.conf, based on what was put in the thread appears to be group_a:   [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]  _TCP_ROUTING = group_a index = _internal     [monitor://$SPLUNK_HOME\var\log\splunk\metrics.log]  _TCP_ROUTING = group_a index = _internal    This should eliminate the _internal logs from being forwarded to the 3rd Party system. ... View more

| tstats count where index=* by index Super late to the party, but this query will get it done for everythign but internals at a fraction of the time.  ... View more

@mohan401  I have similar use case. I am very new to written scripts. Could you please share the scripts that you have written. ... View more

How to use ./splunk list input status by cmd   ... View more

@Richfez  printf is a useful eval func here to do the formatting | eval result=printf("%02d:%02d:%02d", floor(test/3600), floor((test/60)%60), test%60) ... View more

Hello i prepared tabs dashboard but both tabs are running at same time can you help me on this . Thanks lateef     ... View more

One pass rule - NO it will apply the source:: if it matches ...  ... View more

What are outputs of      splunk show shcluster-status splunk show kvstore-status     does those both shows that your SHC is fully functional?  You should run those on any SHC member node. ... View more

I have tried all these too and cannot seem to get deployment server apps checked. the btool output is simply silent. ... View more

I have same issue, tried everything here and still another user on this instance cannot access the query or run the dashboard and it gives him no result. Data is coming out without the | lookup, but when added with lookup, it does not work 😞 ... View more

Are you sending the JSON to HEC? if you want to do custom extraction at index time, make sure you use the HEC URL ending in /collector/raw.   if you use /collector (or /collector/event) endpoint, then it is probably bypassing some customizations. ... View more

Thank you for this - this worked for me! ... View more

In general I use at bare minimum these 6 props settings. I almost always have the should line merge to false, so I not really sure how the specific this setting applies to the pipeline, and how it affects the searchTimeExtractions transform. Feel free to knowledge transfer 😁 I try to avoid line merging for performance issues, and  just try to make more complex line breakers to account for multi lines. SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) TRUNCATE= MAX_TIMESTAMP_LOOKAHEAD= TIME_FORMAT= TIME_PREFIX=     For the delete command you could do something like this in the PROPS file, again I am not to familiar of the deeper level difference between nullQueue vs SEDCMD. Feel free to show me some pros and cons of either:   SEDCMD-removeHeaders = s/name,number,colour//g     ... View more

Great!!! 👍 ... View more

No need to write 2 rex you can achieve same in single rex only, you will not get any output in Result field but field will be created with no data. <yourBasesearch> | rex "(?<DateTime>.*)\s(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s(?<src_user>[^\(]*)\s\((?<userupn>[^\)]*)\)\|(?<message>[^\|]*)\|?(?<Result>.*)?" ... View more

Thank you guys but none of the above works. The field name of the groupid is different in both sourcetype although groupdid is found in the field#2 of both sourcetype ... View more

@ebeid 1) time frame: search=search%20index%3DINDEXNAME%20index_earliest =-2d%20index_latest =now%20QUERY 2) outputmode json: search=search%20index%3DINDEXNAME%20index_earliest =-2d%20index_latest =now%20output_mode=json%20QUERY outputmode xml: search=search%20index%3DINDEXNAME%20index_earliest =-2d%20index_latest =now%20output_mode=xml%20QUERY by default results will be xml check below link, http://docs.splunk.com/Documentation/Splunk/7.0.1/RESTREF/RESTsearch#search.2Fjobs.2Fexport i hope this helps ... View more

I already had Splunk_TA_nix Installed. Thank you so much! This is all I had to do: host="app-1" source="cpu" | gauge cpu_load_percent 25 50 65 75 85 95 100 ... View more

Owner and group of TA NIX application/directory was root and system. Splunk forwarder was installed with some splunk user and this user didn't have the privilege, to supersede root user to execute anything, in that directory. Owner and group changed to splunk and it worked fine. For cpu.sh script, Splunk user was made a part of adm group on AIX server and after that, it was able to execute the sar -P ALL 1 1 command present in the script. Note: Some of the commands present in TA NIX scripts require root privileges, make sure to install the splunk forwarder as root user. In case forwarder installed with some splunk user, need to provide the proper permissions to execute those commands. ... View more