with respect to the Magic 8 should you always try to include them in the props of your various source types for a data set? I am slightly confused as if this is a best practice why most  pre-configured TAs on splunkbase  include the magic 3 or 4 what happened to the rest of them? Is it always a best practice to  include all 8? ... View more

Can you leverage the total derived using the addcoltotals command to support other calculations? i.e. can you use it to calculate a percentage?  | addcoltotals count labelfield="total" | eval percent=((count/total)*100) | table host count percent     ... View more

I see there is a limit in the inputs.conf (1-9) but what about the serverclass.conf file? There is no mention in the documentation.  https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Inputsconf  ... View more

is there a format that needs to be adhered to when using a blacklist with regex?  I am trying to format "New Process Name:" with a regex that will extract events from a specific data source.  I have tested the regex with regex101 and it identifies the events that I want to filter and is basically blacklist3 = New\sProcess\sName\:\s+C\:\\Program\sFiles\s\(x86\)\\...... should that work or do I need to format it something more like blacklist3 = New Process Name = C\:\\Program\sFiles\s\(x86\)\\......  my current blacklist is resulting in  ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - Processing: 'blacklist3' [legacy], range error found in 'regex'...... According to this document, https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/Whitelistorblacklistspecificincomingdata blacklist = <your_custom_regex>  should work.    Thanks ... View more

is there a best practice search to find the last event sent at the start of an outage and the first event the come in after the outage for a specific data source was rectified? Basically what is the best was to identify the outage window in one search? ... View more

I have just upgraded my Splunk deployment server from 7.3 to 8.0 and after upgrading the web UI will not come up. I was trying to troubleshoot and was looking at the web_service.log but for some reason it is empty (0 bytes). I cannot figure out why it is not getting any logs or why the UI drops after the upgrade. Any suggestions would be greatly appreciated. ... View more

Hello, I am new to Splunk and am trying to get the browsing histroy analysis app running on splunk eterprise (demo) that is capturing local logs as well as logs from a UF. I am stummped as I do not know what data input to use and there is not very much documentaion. That I have be able to find. Any help getting the data input setup would bre greatly appreciated. Thanks ... View more