I've been ignoring this number for 8 or 9 years now as it's never made any sense and doesn't correspond to the results of the queries mentioned above.   How does this counter even work? ... View more

did you re- generate the mongo? ... View more

Is there a way to do this in the generic search results?  AKA not via a dashboard?   No matter what I put in the field value it only lets me click it say "include/exclude in search results" and I'm thinking there's no way to override this.   <link> - No <a href="> No http://whatever No     ... View more

https://www.geeksscan.com/ ... View more

Thank you,  im gonna add the details from Slack for anyone else who might come across this.  "...Once a lookup exceeds the max memtable limit, Splunk will bucketify it, creating a kind of mini index." So if you're seeing index.alive or index.default just backlist the respective lookup in distsearch.conf and in rare circumstance you could increase max_mem_usage_mb in limits.conf ... View more

Hi,   Is there any way I can create more than one search bar in the same dashboard?   ... View more

converting UF to use service account seems to have fixed it for me. So if that's not possible at least you know that its a permissions issue with localsystem. ... View more

Thank you for sharing. I found this helpful. ... View more

great! thank you ... View more

Thanks, This worked ... View more

i would make sure to read this How to move index buckets from one host to another If you want to retire a Splunk Enterprise instance and immediately move the data to another instance, you can move individual buckets of an index between hosts, as long as: When you copy individual bucket files, you must make sure that no bucket IDs conflict on the new system. Otherwise, Splunk Enterprise does not start. You might need to rename individual bucket directories after you move them from the source system to the target system. Roll any hot buckets on the source host from hot to warm. Review indexes.conf on the old host to get a list of the indexes on that host. On the target host, create indexes that are identical to the ones on the source system. Copy the index buckets from the source host to the target host. Restart Splunk Enterprise. use robo copy for windows rsync if you're using Linux ... View more

I have this input in my SplunkHome/etc/deployment-apps/appname/local/inputs.conf. And yes I have reloaded my deployment server after the config change. ... View more

Questions ...How can i manage 3000 server if i install UF going forward? So instead of UF if i deploy HF for all 3000 servers how would be the situation? /// UF are light weight and they just send/forward the data to HF or indexer. you should not replace UF with HF. HF is used to reduce the load of Indexer by doing some pre-processing at HF itself. ... View more

Hi @CarsonZa , I ran that query already and found the source consuming the most but there is no increase of logs in actual application server. ... View more

Hello CarsonZa, That works, though using regex would not be the final solution I would like to implement since the majority of the users that perform searches do not possess the required knowledge. I might have to assess the encoding to prevent this from happening. Thanks ... View more

THIS IS UF & Forwarder SERVER OS is UNIX. ... View more

Yes. As a result of changing the permissions it now reads: access = read : [ admin, can_delete, splunk-system-role, user_itsecurity ], write : [ admin, can_delete, splunk-system-role, user_itsecurity ] By default, it was globally shared with everyone. ... View more

you might run chown -Rf splunk. /opt/splunk just to be sure. else you could try to clean the dispatch directory. ./splunk cmd splunkd clean-dispatch help should get you started ... View more

You got me on the right path. I wasn't able to put them into the advanced field for the time picker however I did add it to my search to populate the box at the beginning as so: earliest=$datetime.earliest$ latest=$datetime.latest$ Thank you for your help with this. ... View more

I dont see any link for the windows add-on version 4.8.4 download ? If you know, can you share the download link please ? ... View more

Per George, an expert on Splunk multisite deployments at Rational Cyber, "It seems like their WAN is saturated by replication. They should look at queue fullness and at tcp out connections for replication." ... View more

have a look here there's a couple ways to set that password ... View more

Thank you very much for the quick reply, is very useful your hint! I solved my issue, adding the following line in both inputs.conf in Windows and Microsoft_AD add-on. [perfmon://CPU Load] disabled = 1 index = perfmon instances = * object = Processor useEnglishOnly = true [perfmon://Memory Available] disabled = 1 object = Memory instances = * useEnglishOnly = true index = perfmon ... View more