Check This https://community.splunk.com/t5/Splunk-Search/search-peers-sick/m-p/445481#M170589 ... View more

@splunk_user4  It is possible but very difficult by design of splunk.  When I worked for Northrup Grumman, I wrote a dashboard exactly like this that would display results about users and allow the "SOC" administrator to Enable, disable, or delete a user account on the fly.   I do not recall the specifics of it now, but I will dig and try to find this data because it was certainly a labor of love at the time.   There was one specific scripting part where I had to dump the script output to "null" otherwise the script would hang.  Once I did that, we were able to execute python scripts using winRM to perform account actions. ... View more

@kavyamohan did you get answer or were able to implement this? I have similar requirement and need some guidance.  ... View more

It is saying the following now. I have registered and enrolled already.     My trouble is locating the free course so I can complete it.   You already have this item in your cart. ... View more

Was there answer for this one? I'm experiencing a similar issue.  ... View more

Hi @celina11 , Have you created a new web.conf file in local path ? ... View more

Hi, You can remove this message bu updating the settings Goto : Settings>Server settings > General settings Reduce - Pause indexing if free disk space (in MB) falls below    from 5000 to 500. Please note this is just a configuration which changes the setting to generate the message when the disk space falls below 500MB insted of 5GB(your current setting) As to why your disk space on the new indexer is taking this amount of space, would need a detailed investigation of your confs. If environment is clustered - can you perform 1 check On the cluster master . Goto Settings > Indexer Clustering > Indexes >  Bucket Status Check if there is anything under Indexes with Excess Buckets ... View more

.... | stats count by host | eventstats max(count) as max_value min(count) as min_value | eval diff = max_value - min_value try eventstats ... View more

Hi, after installing the package I copied the server.conf file from other indexer and just update the name. after that i replace the splunk.secret key. and we are back in business. ... View more

Hi, You can use the now() command provided by splunk to get the time of your server at that instance & use strftime command to evaluate today (%d) will give u todays date. Below is an example: | makeresults | eval Now =now() | eval today= strftime(Now,"%d-%m-%Y : %H:%M:%S") | table today The parameters of strftime you can edit according to your need. ... View more

Yes, it is very easy but you also need to convert to time_t (AKA epoch ) integer so it would look like this ... | eval _time = <YourYearFieldHere> . "/" . <YourMonthFieldHere> | eval _time strptime(_time, "%Y/%m") | timechart ... ... View more

Hi Chinmoy, Thanks for Responding. Your logic seems correct, but I need this information in date format. can we do so? Thanks ... View more

Splunk also releases an Overview or Essentials app (branding changed) with each release. Here's the one for 7.3 which highlights major new features: Splunk Essentials for Cloud and Enterprise 7.3 ... View more

index=bigip host="F5-BOU-4K-A.entourage.intra" | transaction session_id | stats avg(duration) AS Avg_Session_time by Client_IP This will do it. But I do not know how to put the average bytes_in for each clientip ... View more

it looks like all your headers are separated by a tab. I would suggest you not use regex instead use a delimiter based approach with using tab as a delimiter. ... View more

I dont think you will be able to recover the deleted app. The CM sync with SH and if it finds an app, not in CM but in SH, it deletes it. So, I would suggest you keep a copy of the app in your cluster master. This will prevent it from deleting. Once the app is present in CM, you can do changes in SH, that won't go away. ... View more

thank you very much for your answer. i try it ,it's worked ... View more

Thank you @chinmoya !!! ... View more

@jip31 : using span=10 will not work as it accumulates all the events falling in the timefame spefied into 1 event If you want to restrict the search to last 10 minutes us can use the below CPU earliest=-10m@m latest=now process_cpu_used_percent>80 | timechart limit=10 useother=false span=10m avg(process_cpu_used_percent) as process_cpu_used_percent by host Span - will give you output in 10 minutes blocks limit = will restrict your output to 10. I would suggest you remove limits as that might truncate your results, if more than 10 hosts go over 80% in the last 10 minutes. ... View more

Hi check this https://answers.splunk.com/answers/750462/whats-the-order-of-operations-for-upgrading-splunk.html ... View more

@shayhibah how have you indexed the two logs? Are they having same/different metadata like index, sourcetype, source? Best approach would be to write you search to pull all required data from index. Then you can apply correlation afterwards (as per your example does not seem like there is any correlation between the two logs). Please provide more information for the community to assist you better. What is your current SPL? How are you correlating log 1 data with log 2? Will name field serve as the key to correlate and find unique events in each log? How many fields can these logs have? Based on your explanation so far, you can try something like the following: index=blah sourcetype IN ("sourcetypeForLog1","sourceTypeForLog2") source="path\log*" | fields name a,b,c,d, | stats min(_time) as _time last(*) as * by name ... View more

The issue with this technique is that I need the format to be 22-Jul for example. Changing the eval strtime command to strftime(_time,"%d-%b") works but only for a month of data. I eventually need this to go over a year worth of data which will end up with this arrangement of headers if I go with this: 01-JAN | 01-FEB .. | 01-DEC | 02-JAN | ... View more

Hi, chin, this is Correct could you please change it to comment so I can approve it as the answer. Also deleting and adding the peer again work sometimes. ... View more

Check the python code that has been coded for the custom command raiseticket. The field ticket_tile is probably defined as string. You might need to change is to lists. If you can share the code, might help better. ... View more