Hello, my deployment server shows 11 errors, however the query doesn't return any results and I have selected all time. Where would I go from here? ... View more

I'm starting to wonder if the FIreEye TA, which also has "hx_cef_syslog", is conflicting because that is also installed. ... View more

Here is an dashboard I have made to find out what are going on. <form version="1.1" theme="dark"> <label>Deployment status</label> <!-- 1.0 1.1 change name 19.12.2019 --> <search id="base_search"> <query> index=_internal OR index=*_internal sourcetype=splunkd host="$Host$" name="$Server$" sc="$Stansa$" app="$App$" result="$Result$" action=Download | table _time host name sc app result </query> </search> <fieldset submitButton="false"> <input type="time"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="Host"> <label>Deployment server</label> <search base="base_search"> <query> | eval data=host | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Server"> <label>Server</label> <search base="base_search"> <query> | rex field=name "bit_(?&lt;server&gt;[^_]+)" | eval data=name | stats count by data server | eval info=server." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Stansa"> <label>Stansa</label> <search base="base_search"> <query> | eval data=sc | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="App"> <label>Application</label> <search base="base_search"> <query> | eval data=app | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Result"> <label>Result</label> <search base="base_search"> <query> | eval data=result | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>Fail</default> </input> </fieldset> <row> <panel> <chart> <search base="base_search"> <query> timechart count by name limit=10 </query> </search> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> </row> <row> <panel> <table> <search base="base_search"> <query> stats count by host name sc app result | sort result | rename host as "Deplyment server" name as Server sc as Stansa app as Application </query> </search> <option name="count">100</option> <format type="color" field="Deplyment server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="Server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="Stansa"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="Application"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="result"> <colorPalette type="map">{"Fail":#DC4E41,"Ok":#53A051}</colorPalette> </format> </table> </panel> </row> </form> ... View more

@jeffland  You’re right. BTW thanks for accepting this answer. Greatly appreciated  ... View more

This drove me nuts for weeks until I found your solution.  Thank you very much! ... View more

Thanks! ... View more

Actually you have to adapt the local.meta from the search app. It has been tested with 8.0.3 1. edit local.meta vi /opt/splunk/etc/apps/search/metadata/local.meta 2. add the following line: [views/job_manager] access = read : [ admin ], write : [ admin ] export = system owner = admin   ... View more

Your 2nd example works like a charm. Thank you! ... View more

This is how setup in splunk, to modify multiple knowledge objects you can create ER (Enhacement Request) with Splunk. ... View more

I guess I assumed that by using the Linux T/A, I wouldn't have to worry about quarks like this? ... View more

I will try this. I had remembered the order all wrong. Thanks for your response! ... View more

The search is definitely working, and thank you! But for some reason, when I set it up as an alert, I can't get it to send an email? I am setting it to "events greater to zero", just like every other alert we've configured. Am I missing something? Thanks! ... View more

You're welcome, glad to hear you were able to solve the issue. And thanks for marking the answer as accepted 🙂 ... View more

This is what I am using now, however by using $YearsAx$, my label literally says "Years = 2017". Then if both 2017 and 2018 are selected, I get "Years = 2017 OR Years = 2018". Not ideal. ... View more

You did it! The last query works! Thank you SO MUCH! If you re-post as an answer, I will accept it! Thanks again! ... View more

I understand what you are saying, but it my case, it's sort of irrelevant. I was trying to solve a field extraction issue. Configuration on the Search Head was corrected, and that fixed the fields. In this case, it didn't matter how the data was indexed. ... View more

Please have a try [monitor:///mnt/logs] sourcetype=someSourcetype index = myindex blacklist = \.gz$ ... View more

Thanks! I'll try it! ... View more

No, it just adds a new field to all events that get indexed that identifies the sending forwarder. ... View more

PICNIC error on this one. 🙂 I didn't have the time range set correctly. As soon as I switched it to "All-Time", it works perfectly. Thank you!! ... View more

The indexes.conf file applies to an individual indexer or peer node, it has no knowledge of how many other members are in the cluster or how much data might be on each member. Therefore your indexes.conf needs to be designed per indexer. For example: [volume:HotWarm] path = /logs maxVolumeDataSizeMB = 700000 That is 683GB per indexer (700000/1024), not 683GB of hot data for the entire cluster. You could narrow down your dbinspect to a single indexer, dividing by the number of indexers should roughly work however that is assuming the data is evenly balanced between your indexer cluster members. Newer splunk versions allow data rebalancing to assist with this. I use the query: | tstats count WHERE index="*" by splunk_server _time span=10m | timechart span=10m sum(count) by splunk_server I then visualize in an area graph with 100% stacked mode to see if the data is even among cluster members or not. If it's not even then you might need to do some tweaking and also run a data rebalance. ... View more

Never mind. I was in the wrong app context on my other Search Heads! ... View more

This exact scenario happened to me, and I also had to add the "-owner" switch to the command. I never needed it before. Thanks for finding this! ... View more

FIxed! This was it! Thank you SO MUCH! ... View more