I have shown the queries I made with set diff and eval below. My aim is to compare the report of 07:00 to 07:00 of the day before at 07:00 every day and the report of that day at 07:00 to 07:00 and to post the difference. Example: To compare the search result from 30 November 07:00 to 1 December 07:00 and the search result from 1 December 07:00 to 2 December 07:00 and send the difference.   | set diff [ search NOERROR 10.217.154.253 OR 10.154.216.57 OR 10.194.41.30 earliest="-3d@d" latest="-2d@d" NOT EVRHSGSN1 NOT "*EPDG*" "*MNC001.MCC286*" "*tac-*" | fields "Query", "View", "Response_1", "Response_2", "Response_3", "Response_4", "Response_5", "Response_6", "Response_7", "Response_8", "Response_9", "Query_Type" | fields - _raw | dedup "Query" "View" | sort "Query"] [ search NOERROR 10.217.154.253 OR 10.154.216.57 OR 10.194.41.30 earliest="-2d@d" latest="-d@d" NOT EVRHSGSN1 NOT "*EPDG*" "*MNC001.MCC286*" "*tac-*" | fields "Query", "View", "Response_1", "Response_2", "Response_3", "Response_4", "Response_5", "Response_6", "Response_7", "Response_8", "Response_9", "Query_Type" | fields - _raw | dedup "Query" "View" | sort "Query"]     ----------------- with eval:         index= "syslog" NOERROR 10.217.154.253 OR 10.154.216.57 OR 10.194.41.30 earliest="11/29/2020:00:00:00" latest="11/29/2020:23:59:59" NOT EVRHSGSN1 NOT "*EPDG*" "*MNC001.MCC286*" "*tac-*" | fields "Query", "View", "Response_1", "Response_2", "Response_3", "Response_4", "Response_5", "Response_6", "Response_7", "Response_8", "Response_9", "Query_Type" | fields - _raw | dedup "Query" "View" | sort "Query" | eval ReportKey=bugun | append [search index= "syslog" NOERROR 10.217.154.253 OR 10.154.216.57 OR 10.194.41.30 earliest="11/28/2020:00:00:00" latest="11/28/2020:23:59:59" NOT EVRHSGSN1 NOT "*EPDG*" "*MNC001.MCC286*" "*tac-*" | fields "Query", "View", "Response_1", "Response_2", "Response_3", "Response_4", "Response_5", "Response_6", "Response_7", "Response_8", "Response_9", "Query_Type" | fields - _raw | dedup "Query" "View" | sort "Query" | eval ReportKey=dun] index= "syslog" NOERROR 10.217.154.253 OR 10.154.216.57 OR 10.194.41.30 earliest="11/29/2020:00:00:00" latest="11/29/2020:23:59:59" NOT EVRHSGSN1 NOT "*EPDG*" "*MNC001.MCC286*" "*tac-*" | fields "Query", "View", "Response_1", "Response_2", "Response_3", "Response_4", "Response_5", "Response_6", "Response_7", "Response_8", "Response_9", "Query_Type" | fields - _raw | dedup "Query" "View" | sort "Query" | eval ReportKey=bugun | append [search index= "syslog" NOERROR 10.217.154.253 OR 10.154.216.57 OR 10.194.41.30 earliest="11/28/2020:00:00:00" latest="11/28/2020:23:59:59" NOT EVRHSGSN1 NOT "*EPDG*" "*MNC001.MCC286*" "*tac-*" | fields "Query", "View", "Response_1", "Response_2", "Response_3", "Response_4", "Response_5", "Response_6", "Response_7", "Response_8", "Response_9", "Query_Type" | fields - _raw | dedup "Query" "View" | sort "Query" | eval ReportKey=dun] ... View more

We are using Splunk Light Version 8.0.0 but have discovered recently that Splunk seems to stop logging for a few days once a new month starts. I've attached the splunkd.logs from 00:00.   09-30-2020 00:00:00.027 +0300 INFO LMStackMgr - finished rollover, new lastRolloverTime=1601413200 09-30-2020 00:00:27.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:00:35.446 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:00:48.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:00:59.027 +0300 INFO LMSlaveInfo - Detected that masterTimeFromSlave(Tue Sep 29 23:59:58 2020) < lastRolloverTime(Wed Sep 30 00:00:00 2020), meaning that the master has already rolled over. Ignore slave persisted usage. 09-30-2020 00:00:59.554 +0300 WARN TcpOutputProc - Cooked connection to ip=10.210.50.94:9997 timed out 09-30-2020 00:01:09.028 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:01:30.030 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:01:35.480 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:01:51.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:01:59.299 +0300 WARN TcpOutputProc - Cooked connection to ip=10.210.50.94:9997 timed out 09-30-2020 00:02:12.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:02:33.031 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:02:35.492 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:02:35.504 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:02:54.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:03:15.028 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:03:35.504 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:03:36.028 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:03:57.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:03:58.786 +0300 WARN TcpOutputProc - Cooked connection to ip=10.210.50.94:9997 timed out 09-30-2020 00:04:19.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:04:35.516 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:04:40.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:05:02.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:05:23.028 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:05:35.528 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:05:44.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:06:05.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:06:27.026 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:06:28.314 +0300 WARN TcpOutputProc - Cooked connection to ip=10.210.50.94:9997 timed out 09-30-2020 00:06:35.540 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:06:48.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:07:18.028 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:07:28.094 +0300 WARN TcpOutputProc - Cooked connection to ip=10.210.50.94:9997 timed out 09-30-2020 00:07:35.551 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:07:40.031 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:08:02.028 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:08:24.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:08:35.563 +0300 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.214.120.71_8089_10.214.120.71_radian01_CD4B2B7B-B69D-4097-B528-0F7B136F6DF1 09-30-2020 00:08:45.033 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:09:07.027 +0300 INFO LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value 09-30-2020 00:09:27.789 +0300 WARN TcpOutputProc - Cooked connection to ip=10.210.50.94:9997 timed out ... View more

I've got a vulnerability scan showing that SSLv3 is enabled on port 8090 on our Splunk 7.1.1   indexer.  In my server.conf file we don't have these lines below:    [sslConfig] sslVersions = *,-ssl2,-ssl3 cipherSuite = TLSv1.2:!eNULL:!aNULL   Is it ok to add them manually to disable  SSLv3 on port 443 (TCP)? ... View more

I can't assign roles to and can't see new users in Splunk search head for last 2 weeks. We have LDAP auth. A part of the Log: 07-06-2020 11:15:31.651 +0300 ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="ext01d3695". Search filter="(&(uid=EXT01D3695)(&(status=1)(l=KAYSERI)))" strategy="TEST-ISTANBUL" ... View more

I have a problem on this search below for last 25 days: index=syslog Reason="Interface physical link is down" OR Reason="Interface physical link is up" NOT mainIfname="Vlanif*" "nw_ra_a98c_01.34_krtti" Normally field7 values are like these ones: Region field7 Date mainIfname Reason count ASYA nw_ra_m02f_01.34pndkdv may 9 GigabitEthernet0/3/6 Interface physical link is up 3 ASYA nw_ra_m02f_01.34pldtwr may 9 GigabitEthernet0/3/24 Interface physical link is up 2 But recently they wee like this: 00:00:00.599 nw_ra_a98c_01.34_krtti 00:00:03.078 nw_ra_a98c_01.34_krtti I think problem may be related to: It started to happen after the disk free alarm. (-Cri- Swap reservation, bottleneck situation, current value: 95.00% exceeds configured threshold: 90.00%. : 07:17 17/02/20) Especially This is not about disk, it's about swap space, the application finishes memory and then goes to swap use. There was memory increase before, but obviously it was insufficient, it is switching to swap again. I need to understand: ''Why they use so many resources?'' ... View more