@ohhhvictor Check your web.conf in system/local has httpport=8000 , also check your server.conf for sslConfig stanza and see if it has sslPassword or not. In past trying to remove sslPassword and restarting splunk has worked for me. ... View more

@rashi83 - In the distributed environment, you need to deploy this app on Search head as well along with the Heavy forwarder. May be this documentation will help https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf ... View more

@t874560 Use this search index="iptv_rdkb" [|inputlookup usersfile.csv] | fields _time Source device.make model userId | stats count by Source make model userId _time | eventstats max(_time) AS max min(_time) AS min by userId | eval max=strftime(max, "%Y/%m/%d %T.%3Q") | eval min=strftime(min, "%Y/%m/%d %T.%3Q") | stats earliest(min) as min earliest(max) as max first(make) as make first(model) as model first(userId) as user by userId ... View more

@burakatabay any update on this? I am having similar issue. ... View more

You can check Search Activity- Deployment - Indexers dashboard on monitoring console and see if there are some long running or real time searches running. Also sometimes when the disks are old the issue comes due to saturation and IOPS performance is slow. You can run some tests to check the IOPS for your indexers. >50% is high utilization . Also splunk support can help you confirm if its IOPS issue if no long running or real time searches are running. ... View more

Usually this problem occurs when there is disk IOPS performance issues. Also some long running searches can coz queues to get filled up as read operations may be blocking the input queue. Check the Monitoring Console -> Resource Usage Machine dashboard. If you see high IOPS bandwidth utilization , it indicated problem with IOPS. What is the current disk IOPS for the indexer having issues? ... View more

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please. ... View more

Hi @suchi01 In the same documentation link you can change version to 6.6.3, it gives you alert.expire option to set the expiration. See below - Configure triggered alert expiration By default, each alert trigger record on the Triggered Alerts page expires after seven days. Here are steps for updating triggered alert expiration. These steps apply only to alerts with the "Add to Triggered Alerts" action enabled. From the top-level navigation bar, select Settings > Searches, reports, and alerts. Locate the alert that you want to modify under Search Name. Select Advanced Edit. Scroll down to alert.expires. Enter an integer and specify one of the following units: seconds (s), minutes (m), hours (h), days (d). For example, to set the alert to expire in 3 days, specify 3d. Click Save. ... View more

@suchi01- This may be helpful from Splunk documentation https://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/Updatealerts Update triggered alert record lifespans By default, each triggered alert record on the Triggered Alerts page expires after 24 hours. You can update the lifespans for triggered alert records on a per-alert basis. Here are steps for updating the lifespans of the triggered alert records for a specific alert. These steps apply only to alerts that have the "Add to Triggered Alerts" action enabled. From the top-level navigation bar, select Settings > Searches, reports, and alerts. (Optional) Select Type > Alerts to filter the list so it displays only alerts. Locate the alert that you want to modify under Name. Select Edit > Edit Alert. Define the lifespan of the triggered alert record by setting the Expires field. Enter an integer and select a time unit from the dropdown. For example, to have all triggered alert records for this alert have a three-day lifespan, enter 3 and select day(s). Click Save. ... View more