Check This https://community.splunk.com/t5/Splunk-Search/search-peers-sick/m-p/445481#M170589 ... View more

Try this https://education.splunk.com/user/learning/enrollments ... View more

Hi, You can remove this message bu updating the settings Goto : Settings>Server settings > General settings Reduce - Pause indexing if free disk space (in MB) falls below    from 5000 to 500. Please note this is just a configuration which changes the setting to generate the message when the disk space falls below 500MB insted of 5GB(your current setting) As to why your disk space on the new indexer is taking this amount of space, would need a detailed investigation of your confs. If environment is clustered - can you perform 1 check On the cluster master . Goto Settings > Indexer Clustering > Indexes >  Bucket Status Check if there is anything under Indexes with Excess Buckets ... View more

Splunk deprecated running scripts with alert actions. You can check that OR How about creating your own custom command. The command can use the output of the search and pass it to the script. You might need to change your script a bit to take in the input. Below link can be helpful in creating a custom command https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/ ... View more

try this: | stats max(cpu_load) as max_tmp min(cpu_load) as min_tmp by host | eventstats max(max_tmp) as max_final min(min_tmp) as min_final | eval max_flag=if(max_tmp=max_final,1,0) , min_flag=if(min_tmp=min_final,1,0) | where min_flag=1 OR max_flag=1 ... View more

So if your dropdown is dynamic. On what criteria are your panels dependent. Like on which kind of selection do you want which panel to be shown. Say down the line you get test5 as an input in the dropdown, then which panel should be visible. ... View more

Check the below dashboard code. It should help you out... Code for dropdown <input type="dropdown" token="choice" searchWhenChanged="true"> <label>Choice</label> <choice value="test1">test1</choice> <choice value="test2">test2</choice> <change> <condition value="test1"> <set token="panel1"></set> <unset token="panel2"></unset> </condition> <condition value="test2"> <unset token="panel1"></unset> <set token="panel2"></set> </condition> </change> <selectFirstChoice>true</selectFirstChoice> </input> Code for panel <panel depends="$panel1$"> <table> <title>Panel1</title> <search> <query>| makeresults | eval panel1 = "Panel1"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> <panel depends="$panel2$"> <table> <title>Panel2</title> <search> <query>| makeresults | eval panel2 = "Panel2"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> ... View more

You can use the bin command to group your data into your desired time-span and then do a distinct count on the ip. Something like index=_internal | bin _time span=5s | stats dc(clientip) ... View more

Hi, Can you run the below command. it might help you in getting the port on which splunk web is running ./splunk show web-port ... View more

Hi Riqbal, Please follow the below steps On the new indexer, log into the splunk UI Go to: Settings->Indexer Clustering Click "Add cluster to be searched" Provide the clustermaster details and the security key. Your new indexer should now be a part of your cluster. ... View more

Check the below link: https://answers.splunk.com/answers/755087/search-peers-sick.html#answer-759155 ... View more

Hi, You can use the now() command provided by splunk to get the time of your server at that instance & use strftime command to evaluate today (%d) will give u todays date. Below is an example: | makeresults | eval Now =now() | eval today= strftime(Now,"%d-%m-%Y : %H:%M:%S") | table today The parameters of strftime you can edit according to your need. ... View more

Yes, its possible. All you need to do it create a new field that the combination of your year and month field. Syntax - eval date_combine = year."-".month ( "-" is used as a delimiter.) You can then use the new field in your chart. Below is an example with the internal index index=_internal | eval date_combine= date_hour."-".date_year | timechart count by date_combine ... View more

Use creates date_mday and date_wday field for all index. Use can use these fields. Below is an example using splunks internal index | tstats values(date_wday) as Day where index=_internal by date_mday | rename date_mday as date | sort date | eval dayFlag = ( floor((date/7)) ) + 1 | eval Message = date." is the ".dayFlag." ".Day." of the Month" | table Message ... View more

A summary index is basically a generic term, in actuality, it's like any other index, we just use it to store data that has been summaries by the splunk query. you should be able to search data index in it by the simple command ie index=(name of your index) ... View more

Try this | tstats values(host) where index=* earliest=0 Above will give you a multivalue field. Personally, I prefer the below | tstats count where index=* earliest=0 by host ... View more

I think its the white space that's creating an issue. Try below | makeresults | eval h="10, 9, 70, 100" | rex mode=sed field=h "s/ //g" | makemv delim="," h | eval smallest=min(h) ... View more

Hi, You can check out the slunk release notes to get the difference between the releases. Below link can help you.. https://docs.splunk.com/Documentation/Splunk/7.3.0/ReleaseNotes/MeetSplunk ... View more

Are all your 60 panels visible at one single instance? ... View more

You would have a configuration in your servers.conf. Ideally, this should be in your system/local. But can differ depending on your configuration. The servers.conf will have a stanza [shclustering]. Remove all configuration under this stanza on all your SH. Do a restart. Your SH clustering will be removed. ... View more

it looks like all your headers are separated by a tab. I would suggest you not use regex instead use a delimiter based approach with using tab as a delimiter. ... View more