Hi,  i've configured Alert Manager App and an alert in the same app. If i check the index (index=alerts), i can find only event with sourcetype = incident_change instead of sourcetype=alert_metadata.   Anyone have the same issue? ... View more

Hello there,  i've a report that is scheduled as follows: * * * * *  But in the next scheduled time i got 2022-01-20 11:53:40 CET but i want 2022-01-20 11:53:00 CET   Is there a way to set seconds?   TY ... View more

Hello there, I got some scheduled reports that write on summary indexes, I scheduled it via a sh script with curl. That's what the script do for every scheduled report: 1. Enable report 2. Schedule report 3. Disable report when the status is done. Often, reports are not scheduled and if I try to schedule it manually, in schedule form appears the following message: Scheduling this report results in removal of the time picker from the report display. Can someone tell me how to fix this isssue? Thanks 🙂 ... View more

Hello there, i'd like to know if I can schedule/enable/disable a DB connect Input with REST API as I do with reports. Anyone knows? Thanks 🙂 ... View more

Hello there, After a stats command, I would like to rename the name of a field using a string and the value of another field eg. fieldname i'd like -> "ABC 2018" but 2018 is stored in a field I've tried with eval {ABC}="ABC".year but it doesn't work. can someone help me? TNX 🙂 ... View more

Hello there, i've a distribuited deployment with a SH and INDX. i've installed DB Connect on the SH and created an input to send data from SH to indexer, i've select an index that's on the INDX but the index have no data. How can i solve this issue? ... View more

Hello there, i got a Catalina log and i don't want to index lines that contains one of that word: API PROXY, WARN, ERROR After that i want to aggregate some lines. I'm using a Single instance deployment of Splunk7.1. Can someone help me to delete the log lines? Thanks ... View more

Hello there, I got an issue while I'm trying to set up the splunk add-on for SN Here is the error: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)",) I'm using Splunk Enterprise 7.0.1 on Win10. Can u pls help me to solve this problem? Thanks. ... View more

Hello there, I need to set as a default always the second element of my list values, the value can change but I need to take always the second one. How can I make that? There's a way with javascript? Thank you. Marzia. ... View more

Hello, I would like the bars of my bar chart to always have the same height regardless of how many values are present in the chart. Is it possible to do it? I tried to insert the option charting.chart.barSpacing and charting.chart.columnSpacing in the XML, but I did not get the result I wanted. Thanks. Marzia ... View more

hi, i want to delete from an index only the events i dont need. i know that the delete command only hide events from the search but it doesnt delete them permanently, i want to save index space to not exceed my license. how can i do this? can i do this from CLI? ... View more