That's the idea. 1. On each indexer you move the data from old location to the new one leaving a symlink behind. 2. You update the path to the index in indexes.conf so that it points to the new location. 3. You remove the symlinks since they're not needed anymore. ... View more

If you're referring to the adaptive response in the correlation search itself, as opposed to the contextual dropdown in the additional fields, you could try using a sequence template to pass relevant fields like event_id from the original correlation search into a subsequent correlation search, and then trigger the response from there. Is there a specific reason you want this to be implemented in Python code rather than a GUI-driven workflow? NB: This solution is untested, so please let us know whether this works for you. ... View more

Where is the default location of CSV output file defined in search string on Windows Server 2016? ... View more

@gdiazlo  I am linux newbie.  What information this script suppose add?  We're getting an error severity with "<no matches>"  what does that mean? ... View more

Using a pie chart graphic -This worked for me...so very cool! Numbers are showing up per slice. Following is the query code. |stats count(ACTION) as Totals by ACTION eval ACTION=ACTION."=".Total   ... View more

How do you add those privileges to the user? ... View more

Timegap Dashboard <form theme="light"> <label>Timegap Example</label> <search> <query>| makeresults | addinfo | eval starttime = strftime(info_min_time, "%m/%d/%Y:%H:%M:%S"), endtime = strftime(info_max_time, "%m/%d/%Y:%H:%M:%S")</query> <earliest>$gapfill_time.earliest$</earliest> <latest>$gapfill_time.latest$</latest> <done> <set token="starttime">$result.starttime$</set> <set token="endtime">$result.endtime$</set> </done> </search> <fieldset submitButton="false"></fieldset> <row> <panel> <title>Always Data</title> <chart> <search> <query>index=_internal date_wday="thursday" | timechart span=1d count</query> <earliest>-14d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> </chart> </panel> <panel> <title>No Data</title> <chart> <search> <query>index=_internal date_wday="thursday" | timechart span=1d count</query> <earliest>-4d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> </chart> </panel> </row> <row> <panel> <title>Always Data</title> <single> <search> <query>index=_internal date_wday="thursday" | timechart span=1d count</query> <earliest>-14d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> </panel> <panel> <title>No Data</title> <single> <search> <query>index=_internal date_wday="thursday" | timechart span=1d count</query> <earliest>-4d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> </panel> </row> <row> <panel> <title>Gapfill - short time</title> <chart> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=-14 end=-1 increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>-4d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> </chart> </panel> <panel> <title>Gapfill - correct time</title> <chart> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=-14 end=-1 increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>-14d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> </chart> </panel> </row> <row> <panel> <title>Gapfill - short time</title> <single> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=-14 end=-1 increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>-4d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> </panel> <panel> <title>Gapfill - correct time</title> <single> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=-14 end=-1 increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>-14d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> </panel> </row> <row> <panel> <title>Gapfill - timepicker wrong</title> <input type="time" token="gapfill_time"> <label>gapfill_time</label> <default> <earliest>-14d@d</earliest> <latest>now</latest> </default> </input> <chart> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=-14 end=-1 increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>$gapfill_time.earliest$</earliest> <latest>$gapfill_time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> </chart> </panel> <panel> <title>Gapfill - timepicker correct</title> <chart> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=$starttime$ end=$endtime$ increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>$gapfill_time.earliest$</earliest> <latest>$gapfill_time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> </chart> </panel> </row> <row> <panel> <title>Gapfill - timepicker wrong</title> <single> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=-14 end=-1 increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>$gapfill_time.earliest$</earliest> <latest>$gapfill_time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> </panel> <panel> <title>Gapfill - timepicker correct</title> <single> <search> <query>index=_internal date_wday="thursday" | fields | eval count=1 | append [ | gentimes start=$starttime$ end=$endtime$ increment=1d | eval _time=starttime, count=0 | fields _time, count ] | timechart span=1d sum(count) as count</query> <earliest>$gapfill_time.earliest$</earliest> <latest>$gapfill_time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> </panel> </row> </form>     ... View more

I now use an updated version, that also compensates for choosing "All Time" in the time picker, which makes info_max_time set to "+Infinity" which unfortunately is not a number. | inputlookup mylookup.csv | addinfo | where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity") ... View more

Actually there was no need for me to store the values in a new field. Thanks ... View more

You can probably achieve it with the reltime command and setting it to a token from within a hidden search.  https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Reltime Here is an example dashboard: <form> <label>Reltime</label> <search> <query> | makeresults | addinfo | eval _time = info_min_time | reltime | rename reltime as reltime1 | eval _time = info_max_time | reltime | rename reltime as reltime2 </query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> <done> <set token="reltime1">$result.reltime1$</set> <set token="reltime2">$result.reltime2$</set> </done> </search> <fieldset submitButton="false"> <input type="time" token="time_token"> <label></label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Events between $reltime1$ and $reltime2$</title> <table> <search> <query> | makeresults | addinfo | eval _time = info_min_time | reltime | rename reltime as reltime1 | eval _time = info_max_time | reltime | rename reltime as reltime2 </query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   ... View more

Maybe something like this?  (<YOUR FIRST SEARCH>) OR (<YOUR SECOND SEARCH>) | eventstats values(TYPE) as TYPE by ID | stats count by ID, TYPE, timerName ... View more

Note: This option only works correctly if every row in the input has only 1 of the fields with a value.  ... View more

Two solutions for the price of one. Thanks!! Throttling did the job. ... View more

This is what I ended up with: | tstats max(_time) AS _time WHERE index=_internal sourcetype=splunkd source=*metrics.log by host | rex field=host "^(?[^\.]+)" | lookup serverswithsplunkufjan2020 host OUTPUT host as match | where isnotnull(match) | inputlookup serverswithsplunkufjan2020 append=true | rex field=host "^(?[^*]+)" | dedup host | eval "Sending Data?" = if(isnotnull(_time), "Yes", "No") | stats max(_time) AS _time by host "Sending Data?" | convert timeformat="%Y/%m/%d" ctime(_time) as "Last Send Date" | fields - _time ... View more

I also had problems with the Data inventory after an update. I found that the Data in my kv store lookup "data_inventory_products_lookup" was likely outdated from a previous version. The Addon ships with newer data in SSE-default-data-inventory-products.csv but on update was not loaded into the KV store. So my issue was fixed by: | inputlookup SSE-default-data-inventory-products.csv | outputlookup data_inventory_products_lookup ... View more

Yes, now you should have the buttons for Introspection back and there is a button in the popup menu, that says "Reset all Configurations". Hit it and afterwards it should be fine again. ... View more

The same problem with the whenChanged attribute ... View more

Thanks! Has the same problem today and changing the captain did not help. But running this on the problematic host, solved it. ... View more

Because of : Caused by: java.net.ConnectException: Connection refused: connect I am guessing firewall. ... View more

Peter, I developed a report that runs each week, and sends me the reults fo the following search string: index=_audit source=audittrail operation=edit action!=search action=edit_roles You could modify this search with other parameters that suit your particular needs or frequency. The above, will show you all mods made to the admin role. I hope that helps. Thanks! ... View more

From what you described, you wouldn't even need Splunk Cloud. You could spin-up a few VMs on any Cloud services platform (e.g. AWS, Digital Ocean, etc.), install Splunk on them, configure them as a search head cluster, and point them at your master node so that they can search your on-prem indexer clusters. ... View more

Here's additional information on 500 Internal server error with 6.4 Release: HTTPS_PROXY in splunk-launch.conf causes 500 Internal Server Error after login. To work around this issue: Option 1: Export the following setting into your environment prior to starting Splunk Enterprise: NO_PROXY="127.0.0.1,localhost" export NO_PROXY="127.0.0.1,localhost" or add it to $SPLUNK_HOME/etc/splunk-launch.conf and restart Splunk Enterprise. Option 2: Unset the proxy on the Linux system and restart Splunk Enterprise: echo $http{,s}_proxy unset $http{,s}_proxy If the proxy is set in splunk-launch.conf but is not actually used or needed, remove the setting and restart. ... View more

I was able to use the following workaround for the time being. You can select earliest and latest values in the SPL. index=test earliest="-1d@d" latest="@d" | ... But if anybody has a real solution to this I would appreciate it. ... View more