I have a dashboard with 65 panels (all are parsers). It is taking a while to load. I am having 4 base searches to use across the 65 panels, still I am facing some lag in loading the entire dashboard.  For a better viewability, I categorized the panels based on their utility and showing them in tabs using CSS. For for performance perspective, I dont find any other option other then using Base Search, but it isn't helping me either.  Please provide effective ideas for improving the performance without recuding the number of panels involved. ... View more

I am trying to find the occurrence whenever the state changes due to the error. Below are my sample events: 2021/08/01 07:12:12.098 host=12345 In 2021/08/01 07:13:12.098 host=12345 In 2021/08/01 07:14:12.098 host=12345 Out 2021/08/01 07:15:12.098 host=12345 Out 2021/08/01 07:16:12.098 host=12345 In 2021/08/01 07:17:12.098 host=12345 In 2021/08/01 07:18:12.098 host=12345 Out 2021/08/01 07:18:35.098 host=12345 ERROR 2021/08/01 07:19:12.098 host=12345 In 2021/08/01 07:20:12.098 host=12345 Out I need to group the events when the state (In/Out) changed due an ERROR event. For the above sample events, I should not get any result. Because, when the ERROR event happened, the host is already in "Out" stage. We need to monitor only when a "In" host changes to "Out" due to an ERROR. I tried the below search   index=myindex ("Cut-In" OR "Cut-Out" OR "ERROR") | rex "host=(?<host>\d+) (?<State>.*)" | transaction host startswith="State=In" endswith="Out" maxspan=24h | where searchmatch("ERROR") | table _time host   But the above query returns a result by grouping the "In" state which logged at "07:16:12" as start of the transaction and "07:20:12" as end of the transaction. This is not a valid scenario. Please help me in framing the logic. ... View more

I have a transaction similar to the below one: 02/06/2018 15:10:30.560 Starting transaction 02/06/2018 15:20:90.150 Message A 02/06/2018 15:21:33.480 Message B 02/06/2018 15:23:57.442 Message B 02/06/2018 15:24:12.772 Message B I need to find the timestamp of the first occurrence of the message B event i.e., 02/06/2018 15:21:33.480 in the above example. I cannot use endswith=Message B, as I also need the events that happened after it. Appreciate for the suggestions. ... View more

I have configured the Data Input REST API settings as per the following link. While trying with the REST URL in browser I am getting the JSON response. But, when I tried to test it in Splunk, I am getting the following error in splunkd -0500 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\rest_ta\bin\rest.py"" Exception performing request: HTTPSConnectionPool(host='api.nytimes.com', port=443): Max retries exceeded with url: /svc/search/v2/articlesearch.json?api-key=7d61953a50c1446e9e95aa634f35fa9c&sort=newest&q=snow (Caused by <class 'socket.error'>: [Errno 10054] An existing connection was forcibly closed by the remote host) I am getting the same error for any REST API. I have used REST API Modular Input app, Splunk Add-on Builder App to test this REST API Input, but with no luck. ... View more

I haven't used any lookup table in my dashboard. But still I am facing "The lookup table XXX does not exist. It is referenced by configuration YYY" error. I have checked the permission settings of XXX in Lookup definitions, Automatic lookup, Lookup table files & Configuration settings of YYY. Each one is been set as Global. What's wrong with my Splunk then? ... View more

I have the following log data: Number of Users:3 [1]UserId:1 NumberOfUserRoles:2 [1]UserRoleCode:1 UserRoleText:Admin [2]UserRoleCode:2 UserRoleText:Developer [2]UserId:2 NumberOfUserRoles:1 [1]UserRoleCode:1 UserRoleText:Developer [3]UserId:3 NumberOfUserRoles:1 [1]UserRoleCode:1 UserRoleText:Tester I need to parse the above fields as following result: NumberOfUsers UserId UserRoleCode UserRoleText 3 1 1 Admin 2 Developer 2 1 Developer 3 1 Tester In the above results, UserId, UserRoleCode & UserRoleText are multivalue fields. I used traditional rex command with max_match attribute but this is not working. | rex "Number of Users:(?<NumberOfUsers >\d+)" | rex max_match=0 "UserId:(?<UserId>\d+) NumberOfUserRoles:(?<NumberOfUserRoles>\d+)\n(?<teststring>.*)" | rex max_match=0 field="teststring" "UserRoleCode:(?<UserRoleCode>\d+) UserRoleText<.*>:(?<UserRoleText>.*)$" But the above is not working. Please suggest how to parse the above message to get the expected result. Thanks. ... View more

I am facing a weird issue with sid. I have a saved sid with yesterday's (00:00 to 23:59) data, which is showing a dip in my messages during yesterday evening. But, for the same query (since there is no change in the query, i believe I don't need to provide my query here) and for the same time frame, if I try to run as a new search, I do not see the dip. Since, both are having same query & timeframe, how the results would change? Is there any difference in this? Someone please explain. ... View more