Whoever decided that field X is supposed to be INDEXED into metadata, should have done the last step which is setting up fields.conf in the Search Head where the field is supposed to be searched for. So you can do a rest call to that fields.conf and see what has been defined there:  https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/Configureindex-timefieldextraction#Add_an_entry_to_fields.conf_for_the_new_field | rest /services/configs/conf-fields | where INDEXED=1 | table title You can then relate the field name with props.conf and transforms by issuing similar calls ... View more

No need to change the server. If the specs were for 6.5, you'll be fine now with 7.3 ... View more

I don't see any issue in maintaining AMI as OS for Splunk, I have seen it myself very recently in customers of mine. Please upvote and accept the answer if you are happy with it ... View more

Don't you have a Cluster Master too? The order should be: 1 - License 2 - Cluster Master 3 - Deployer - Upgrade it but keep it shutdown until you upgrade your Search Heads, so they don't contact a Deployer in a different version 4 - Search Heads 5 - Indexers 6 - Heavy Forwarders If you have a multi-site indexers cluster and you're not willing to shutdown all sites to do the upgrade in all of them at once, for it to be a Splunk Supported upgrade you need to have intermediate upgrades at 7.0, 7.1, 7.2 and finally 7.3. If you can shut all indexers down, then it would be a straight upgrade to 7.3 ... View more

I wouldn't change those parameters. The Java sdk is explicit that you can Target count and offset to iterate it with a regular loop. That version your're using is quite old and if your code is really bugless, there may be a problem on 6.5.9. I'm assuming you're going through https://dev.splunk.com/enterprise/docs/javascript/sdk-javascript/howtousesdkjavascript/howtosearchsdkjavascript/ ... View more

I'm confused by what you have vs what you want. You're showing Splunk outputs a 5m bin x-axis, but you're getting a day variable to split by but you're expecting an hourly split in the end... What am I missing? ... View more

What kind of iteration are you really trying to do? ... View more

You can use a subsearch of makeresults . You apply your eval nowstr="serial ".strftime(now(), "%Y%m%d")."02)" within the makeresults and do a return $nowstr . In the end something like this: Search sourcetype=named [ | makeresults | eval nowstr="serial ".strftime(now(), "%Y%m%d")."02)" | return $nowstr] Let me know ... View more

Seems you have material to build a static lookup. Your sourcetype A that has the description can be outputed to a lookups that you can use to enrich your stats on sourcetype B ... View more

After the timechart you can again use strftime to stripe the date part of it ... View more

Doesn't this work for you? index=<yourindex> earliest=-30d latest=-7d | stats count(X) ... View more

^((?!abc).)* This regex shall negate the string exists. ... View more

You need to run that command in the member that had the issue, and you'd have "The member has been synced to the latest replicated configurations on the captain." Is that what you've done? run the resync command on the member with the issue? ... View more

There's a parameter controlling when the changes are erased in server.conf: conf_replication_purge.eligibile_age. Its default is one day (86400 secs). What do you mean "I have ran this command from two days" ? ... View more

Have you configured your account and access logs input maybe via an S3 to SQS based input? ... View more

Can you explain what you're looking to get out of that ? ... View more

Got ya. So that message is much more informative. Your SHC members need to inform the captain of changes they make, so he replicates them to the remaining ones. The problem is what your member is pushing is too far back compared to what the captain has. So you need to ensure there is a common baseline in all of them, meaning you need to resync them. I'd start by splunk show shcluster-status and check the last_replication_conf in the one not the captain and compare to the captain. A manual resync of the members should then be done so they share a common commit. Follow the doc here: https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/HowconfrepoworksinSHC#Perform_a_manual_resync ... View more

You can enable more.agressive logging for the shc components and see what it says. Is your network connection between members ok? Can you check it? ... View more

What issues are you facing? Have you checked the internals for shc deployer pushing errors first? Deleting the search artifacts residing in /var/run/ won't necessarily help ... View more

I've been through that. Change your special chars to unicode like \x5C for \\ in the props extract and it may solve your problem there. The escaping works different between rex on SPL and a props inline extract https://www.utf8-chartable.de/unicode-utf8-table.pl?unicodeinhtml=hex ... View more

I don't get where is that lookup coming from. It is not in the most up to date app for win infra or in the Windows TA. The eventtype you had a problem before is in the TA for windows https://splunkbase.splunk.com/app/742/ Make sure you install that in your search head so you can get search enrichments you want. Besides that, I'd check on your splunk env where that lookup is referred cause I really can't find it ... View more

either you're willing to run 4 searches, one for each week, which can be done like this: | makeresults | eval earliest=<week2_begins>, latest=<week1_ends>, weeknumber=1 | append [ | makeresults | eval earliest=<week2_begins>, latest=<week2_ends>, weeknumber=2 ] | append [ | makeresults | eval earliest=<week3_begins>, latest=<week3_ends>,weeknumber=3 ] | append [ | makeresults | eval earliest=<week4_begins>, latest=<week4_ends>, weeknumber=4 ] | map search="search index=en_amp_api earliest=$earliest$ latest=$latest$ | eval description=$weeknumber$" Or you specify earliest and latest that includes all the 4 weeks index=<yourindex> earliest=<week1_begins> latest=<week4_ends> | stats sum(eval(if(last_seen<strftime(relative_time(_time,"-4w"),"%Y-%m-%dT%H:%M:%SZ"),1,0))) as "week1", sum(eval(if(strftime(relative_time(_time,"-4w"),"%Y-%m-%dT%H:%M:%SZ")<last_seen AND last_seen<strftime(relative_time(_time,"-3w"),"%Y-%m-%dT%H:%M:%SZ"),1,0))) as "week2" ... View more

You can specify search (earliest=x latest=y) OR (earliest=w latest=z) ... View more