I have same issue, tried everything here and still another user on this instance cannot access the query or run the dashboard and it gives him no result. Data is coming out without the | lookup, but when added with lookup, it does not work 😞 ... View more

Actually you have to adapt the local.meta from the search app. It has been tested with 8.0.3 1. edit local.meta vi /opt/splunk/etc/apps/search/metadata/local.meta 2. add the following line: [views/job_manager] access = read : [ admin ], write : [ admin ] export = system owner = admin   ... View more

Check out the highlighted issue in the release notes. This caused our CPU to spike when we upgraded last week. http://docs.splunk.com/Documentation/Splunk/7.1.1/ReleaseNotes/Knownissues#Highlighted_issues ... View more

I was just dropping the .csv in the auto index folder- a simple copy and paste into the directory- do you know why a file could be locked? I appreciate your help! ... View more

thank you! ... View more

The partial file is probably caused by whatever tool you use to upload the csv file, apparently it does so in chunks and only once complete, renames it to the proper filename. It appears this is taking so long that Splunk already picks up on the partial file, before the upload completes. So I would expect Splunk will only hold a subset of events with source=*partial compared to the proper source. Making the monitor path more specific as suggested by micahkemp would indeed fix that. ... View more

Did you modify the job_management.xml in any way? ... View more

I'm sorry no one helped you on this- you need to add more tags to your questions I think I always use all 5 of my available tags ... View more

hey Have you configured anything that is use for extraction in props.conf? you have to remove the extraction from your props.conf on your forwarder. Universal Forwarders cannot extract fields (they can only filter events). To extract fields with a forwarder you would need a heavy forwarder. have a look at this answers https://answers.splunk.com/answers/387158/bug-during-applypendingmetadata-header-processor-d.html https://answers.splunk.com/answers/489579/error-bug-during-applypendingmetadata-header-proce.html let me know if this helps! ... View more

thank you this works! ... View more

There is no way to differentiate just based on field name as fieldnames can be same between different sources. If your expression/logic needs to be different for different sources (though applied on same field name), then you'd need to include source identifier field (field/fields that can uniquely identify source) into your expressions/logic. e.g. For same original problem, with different expression for sourceA and sourceB (assuming field source is uniq identifier), so set the value of field Email differently, you can do like this: | eval "$fieldToMatch$"= case("$fieldToMatch$"=="Email" AND source="sourceA", coalesce(Email,NotifyAddress), "$fieldToMatch$"=="Email" AND source="sourceB", coalesce(Email,Receipiers), , 1=1, '$fieldToMatch$') ... View more

Because you're using INDEXED_EXTRACTIONS for this data, splunk will automatically put them in the tsidx file associated with the itcc:snow sourcetype. Example tstats search against your data: | tstats count as total from <your_index> groupby _time, Company | timechart sum(total) by Company If you applied your own field names in the beginning (read: index time) you wouldn't have to do the coalesce or FIELDALIAS calisthenics to get your data to look the way you want. 😉 Example configuration (on forwarder): [itcc:snow] INDEXED_EXTRACTIONS = csv TRUNCATE = 50000 SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = Opened HEADER_FIELD_LINE_NUMBER = 30 FIELD_NAMES = assigned_to, business_service, category, closed_at, closed_by, close_code company ... ... View more

Yes, restrictions to index data is pretty solid. ... View more

In Access control, create a new role in Splunk and give the access permission on that index. Then you can assign this role to only the user you want that index to access. You cannot achieve this without adding groups in your LDAP strategy. You need to create the group under your LDAP strategy and then map role to the new LDAP group. Yes, "All internal indexes" does not have access to "test" index. ... View more

Hi katzr, I think you have a wrong understanding how data retention in splunk works. An index is comprised of countless buckets that store historical data from different time ranges. After the retention time has passed and all the data in a bucket is older than the retention period the data gets to the FROZEN state. Normally it get's deleted unless you are planning to do something else with it. So you won't have any problems with what you were describing at any time. If you are still eager to tackle even the most unlikely scenario you could set a parameter at the index in indexes.conf called maxHotSpanSecs Example: [main] ... maxHotSpanSecs = 86399 ... Why set the parameter to 86399 instead of 86400? It caused bugs in the past when it was set to exactly 86400. Don't know why or if still the case, but as a safety measure set it to 86399. If you wanna know more about how this actually works out look here: https://answers.splunk.com/answers/88457/difference-between-maxhotidlesecs-and-maxhotspansecs.html ... View more

@sbbadri This displays (Region="*") or (Region="NORTH AMERICA") - I just want to display the label like All or NORTH AMERICA. I'm pretty sure I have to use conditions for the labels but I can't figure out how to get it to work. ... View more

Hi @traxxasbreaker I changed all of the ownership in local.meta to my username and then I ran server:8000/en-US/debug/refresh, but I got the following errors. Can you help me understand how to fix these and what impact these have? Refreshing admin/collections-conf BadRequest In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='katz.r') Refreshing admin/indexes InternalServerError In handler 'indexes': reload is not safe since a path has been deleted or modified for an index, or an index has been disabled. You must restart the Splunk Server, for your changes to take effect. Refreshing admin/remote_indexes BadRequest In handler 'remote_indexes': The following required arguments are missing: repositoryLocation. Refreshing admin/search-head-bundles SplunkdConnectionException Splunkd daemon is not responding: ("Error connecting to /servicesNS/katz.r/search/admin/search-head-bundles: ('The read operation timed out',)",) Refreshing admin/transforms-reload ResourceNotFound In handler 'transforms-reload': Invalid action for this internal handler (handler: transforms-reload, supported: list|_reload, wanted: list). I did this for a user that was already removed in the past and object ownership not transferred, but I am still getting this error below. When I search index=_internal sourcetype=splunkd log_level=ERROR I am still getting the error "0400 ERROR UserManagerPro - Failed to get LDAP user=(name of removed user) from any configured servers ... View more

After lookup, expand you date field, using mvexpand command, and do your strptime & where functions. |mvexpand date | eval Date=strptime(date,"%m/%d/%Y") | where Date > relative_time(now(),"-21d@d") ... View more

Try this for your search (check starting/ending of the search per your requirement) index=example earliest=-6mon@mon latest=now (assignment_group="*") | fields contact_type ... whatever else you absolutely need... | eval _time = relative_time(_time,"@mon") | eval BaselineNumber=if(_time>=strptime("06/01/2017","%m/%d/%Y"),number,null()) | rename COMMENT as "If it's not a fixed date, use relative_time(now(),"@y+5mon") instead of strptime("06/01/2017","%m/%d/%Y")" | eval AverageNumber = if(_time>=relative_time(now(),"-3mon@mon") AND _time<relative_time(now(),"@mon"),number,null()) | rename COMMENT as "The above commands are streaming and distributable, so should be above the dedup unless you have LOTS of dups." | rename COMMENT as "By using the value of field number directly you can avoid expesive eval-case in stats" | stats dc(BaselineNumber) as BaselineTickets dc(AverageNumber) as AverageTickets by contact_type _time | stats avg(BaselineTickets) as Baseline avg(AverageTickets) as Average by contact_type | eval Baseline = round(Baseline,0) | eval Average = round(Average,0) ... View more

Hi @DalJeanis I appreciate all of your help. A lot of the searches are the same format as the one above, but are looking at it from tickets by region, problem, category, etc. instead of contact_type. But the baseline and average parameters are the same. ... View more

Hi @DalJeanis I figured out the problem- the AverageTickets in your example is computing the average over the whole time period- which includes 0s in the dc so it is bringing down the average which should be computed only over the past 3 months- not the whole time period. Example below _time AverageTickets 17-5 0 17-6 0 17-7 100 17-8 120 17-9 130 17-10 140 So the 0s are bringing down the average ... View more

@katzr - I put my comments on the other question you posted the search on. It can be simplified fairly easily to a single join. The earliest/lastest and the sections with ... need to be coded to meet your specifications for Baseline and Average. ... View more

yes it does. So then I kept the file in the auto-index folder and edited the inputs.conf again to remove the *.csv and restated splunk again and my file was indexed- I don't know why it is operating this way. ... View more