Hello, @AL3Z  I would check first Cloud Monitoring Console, Use the Indexing dashboards - Splunk Documentation and for start, run something like this in search: | metadata type=hosts index=* Also check: Learn about the data in your Splunk deployment - Splunk Documentation Getting data into Cloud Platform - Splunk Lantern ... View more

Hello, @mninansplunk There is an Example Hub for Splunk Dashboard Studio. https://your_splunk:8000/en-GB/app/splunk-dashboard-studio/example-hub-icon-coloring   ... View more

I tried that, but that is not working @dauren_akilbeko          "overlayFields": [             "OTP Rolling Average",             "Target"         ], But it wont overlay  "OTP Rolling Average" ... View more

Could you share screenshots/search results for API user capabilities and Splunk version? ... View more

Hi @dauren_akilbeko , Do you have some sample code to share on how can I implement it ? ... View more

It times out or DAG errors. ... View more

The reason for list rather than values is to keep the count and process in line because values sorts them. If you can't use list, you should consider creating a concatenated field before using values. ... View more

I already passed  Splunk Fundamentals 1. I'll check the others, thanks ... View more

Hi Priya, you were saying about logs ingestion at HF and filtering at HF? or you were saying about the "alerts" email notification subject line?    Maybe, You could send a direct message here from your profile to me, so that we can understand and resolve your issue faster, thanks.  ... View more

Thanks for the fast response, I will check if his is a solution for us. Manuel   ... View more

Hi Troyfred One suggestion is instead of forwarding the logs from one indexer to another. You can configure the UF to send only specific monitors to the second indexer( Or even both indexers) via _TCP_ROUTING. Define two different routing groups for both scenarios in outputs.conf and declare the group in inputs.conf. Refer inputs.conf.specs for more info https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ... View more

Hi, I hope below link will give you an idea. https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html Regards, Tejas ... View more

This drove me crazy until I figured it out. I forget how long it took... ... View more

Thank you for the comment, I think I have already included those. Currently facing these 2 errors ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Invalid sub-ID in (ObjectSyntax().setComponentByPosition(0, SimpleSyntax().setComponentByPosition(2, ObjectIdentifier(1.3.6.1.4.1.6889.2.18.1.1.1.0.1))), None, None, None, None) at ObjectIdentifier snmp_stanza:snmp://Thad Test ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Can't coerce BindValue().setComponentByPosition(0, ObjectSyntax().setComponentByPosition(1, ApplicationSyntax().setComponentByPosition(2, TimeTicks(133862679)))) into integer: _BindValue instance has no attribute 'trunc_' snmp_stanza:snmp://Thad Test ... View more

I can confirm - this is the definitely the issue!! Thanks hayduk - I will escalate this as much as I can -ali from Splunk PS ... View more

Good luck with exams! ... View more

Hi All, I found the solution. We can use "REST API Modular Input" and access the RabbitMQ API and index the json response into Splunk. ... View more

You could blacklist them. ... View more

Right, yeah, UF doesn't do linebreaking, that happens on the indexer, so that config needs to be there. I'll convert my comment with the working linebreaking setting to an answer, so you can mark that as accepted. ... View more

I think running the script with the wrong parameters the first time may have screwed something up. I don't know what's going on, but I'd suggest uninstalling the SplunkUniversalForwarder from the target machine (and making sure that C:\Program Files (x86)\SplunkUniversalForwarder no longer exists) and retrying the installation snippet. ... View more

Thx for this post - got my KV store going again. It seems like the upgrade to 7.2.x would have done this step for you since it was a required step! ... View more

I use "index=_internal log_level=ERROR" and last eerors is: 09-20-2018 16:40:21.585 +0500 ERROR KVStoreBulletinBoardManager - KV Store changed status to failed. KVStore process terminated. 09-20-2018 16:40:21.584 +0500 ERROR KVStoreBulletinBoardManager - KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log for details. 09-20-2018 16:40:21.568 +0500 ERROR MongodRunner - mongod exited abnormally (exit code 14, status: exited with code 14) - look at mongod.log to investigate. 2018-09-20 11:53:28,490 ERROR [5ba0dbbf9d126fbfbf240] root:130 - ENGINE: Handler for console events already off. ... View more

Search Head is the one which we use for searching the logs from indexer... Basically the Full Splunk instance can act as Heavy Forwarder/Indexer/Search head...its just a configuration due to which it acts different. https://answers.splunk.com/answers/1324/what-is-a-search-head.html ... View more