Whoever decided that field X is supposed to be INDEXED into metadata, should have done the last step which is setting up fields.conf in the Search Head where the field is supposed to be searched for. So you can do a rest call to that fields.conf and see what has been defined there:  https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/Configureindex-timefieldextraction#Add_an_entry_to_fields.conf_for_the_new_field | rest /services/configs/conf-fields | where INDEXED=1 | table title You can then relate the field name with props.conf and transforms by issuing similar calls ... View more

No need to change the server. If the specs were for 6.5, you'll be fine now with 7.3 ... View more

I don't see any issue in maintaining AMI as OS for Splunk, I have seen it myself very recently in customers of mine. Please upvote and accept the answer if you are happy with it ... View more

Don't you have a Cluster Master too? The order should be: 1 - License 2 - Cluster Master 3 - Deployer - Upgrade it but keep it shutdown until you upgrade your Search Heads, so they don't contact a Deployer in a different version 4 - Search Heads 5 - Indexers 6 - Heavy Forwarders If you have a multi-site indexers cluster and you're not willing to shutdown all sites to do the upgrade in all of them at once, for it to be a Splunk Supported upgrade you need to have intermediate upgrades at 7.0, 7.1, 7.2 and finally 7.3. If you can shut all indexers down, then it would be a straight upgrade to 7.3 ... View more

I wouldn't change those parameters. The Java sdk is explicit that you can Target count and offset to iterate it with a regular loop. That version your're using is quite old and if your code is really bugless, there may be a problem on 6.5.9. I'm assuming you're going through https://dev.splunk.com/enterprise/docs/javascript/sdk-javascript/howtousesdkjavascript/howtosearchsdkjavascript/ ... View more

I'm confused by what you have vs what you want. You're showing Splunk outputs a 5m bin x-axis, but you're getting a day variable to split by but you're expecting an hourly split in the end... What am I missing? ... View more

What kind of iteration are you really trying to do? ... View more

You can use a subsearch of makeresults . You apply your eval nowstr="serial ".strftime(now(), "%Y%m%d")."02)" within the makeresults and do a return $nowstr . In the end something like this: Search sourcetype=named [ | makeresults | eval nowstr="serial ".strftime(now(), "%Y%m%d")."02)" | return $nowstr] Let me know ... View more

Seems you have material to build a static lookup. Your sourcetype A that has the description can be outputed to a lookups that you can use to enrich your stats on sourcetype B ... View more

After the timechart you can again use strftime to stripe the date part of it ... View more

Doesn't this work for you? index=<yourindex> earliest=-30d latest=-7d | stats count(X) ... View more

^((?!abc).)* This regex shall negate the string exists. ... View more

You need to run that command in the member that had the issue, and you'd have "The member has been synced to the latest replicated configurations on the captain." Is that what you've done? run the resync command on the member with the issue? ... View more