There isn't currently any out of the box dashboards, but you can always create a dashboard using searches on the data. ... View more

Splunk OpenTelemetry Collector for Kubernetes enables to collect data from OpenTelemetry to Splunk Enterprise\Cloud HEC.   https://github.com/signalfx/splunk-otel-collector-chart   Splunk Cloud or Splunk Enterprise via the splunk_hec exporter. ... View more

Maybe you want to check "Website Monitoring app" https://splunkbase.splunk.com/app/1493/   ... View more

Adding list_settings to the role is the correct solution for Excel export tool. Works for me as well Thanks! ... View more

According to the official guide, it does support universal forwarder: https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream#Manually_install_Splunk_TA_stream_on_remote_universal_forwarders ... View more

You can try the Angular Examples app, for demonstrations of using Angular within Splunk HTML dashboard: https://splunkbase.splunk.com/app/4045/ ... View more

Ok I eventually used javascript to extract that data, so that's a decent workaround. Can you make your comment as an answer so I can mark that as correct answer? BTW, I used your User talk on splunk wiki a lot, thanks for that! ... View more

@niketnitay , window.location.href shows the current url, while document.referrer shows the previous url (the one that linked to this site) ... View more

You can add new Identities with encryption in DB Connect 3.x: Use the REST endpoint: https://splunkserver:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/identities Example: curl -k -X POST -u admin:password https://splunkserver:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/identities -d "{\"name\":\"myuser\",\"username\":\"myuser\",\"password\":\"mypassword\"}" ... View more

Hi I can easily find all groups that the user is member of in LDAP. But lets say he has hundreds of them, and multiple groups can participate in the mapping process, How can I tell which of them used in the mapping process? ... View more

One of my customers is building its ES environment, and have real trouble with that realtime delay. What is the meaning of reducing "indexed_realtime_disk_sync_delay" to the minimum (for example 1) Why should it be at least 30? Thanks. ... View more

Please post the following: outputs.conf of the heavy forwarder inputs.conf of the DB connect of heavy forwarder Also please run in the cloud search head index=_internal |top host index=_internal host=[heavy forwarder hostname] ... View more

Excellent! If that worked you can mark the answer as successful. ... View more

We have 3 major location options, two of them expand into local+default. Plus we have permission options within the app: (app\global) Major: Private App System Expanded to default\local: Private App-default App-local System-default System-local Expanded to app\global: Private App-default (App-only) App-local (App-only) App-default (Global) App-local (Global) System-default System-local The override order would be: Private App-default (App-only) App-local (App-only) System-local App-default (Global) App-local (Global) System-default ... View more

The best approach for subsearch filter is to use the return function: |return 100 x -> return one field named "search" with first 100 values in one row, field name included: "x=value1 OR x=value2 OR x=value3" |return 100 $x -> return one field named "search" with first 100 values in one row, no field name included: "value1 OR value2 OR value3" index=my_index [search index=my_index abcd|table x|return 100 x] |table y index=my_index [search index=my_index abcd|table x|return 100 $x] |table ... View more

I believe you have a misunderstood the purpose of the cluster master. It is not purposed to deliver events into the indexers, but only to manager their settings. To deliver events (forward events), you would need to set up a forwarder machine. Having said that, it is technically possible to use a cluster master and a heavy forwarder on the same splunk instance, but it's not recommended. Configure your cluster master to forward into the indexers as described here: http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Forwardmasterdata ... View more

First of all I would recommend to read this doc: http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Basicclusterarchitecture The concept goes like this: Splunk has 3 main layers in its architecture: Search Index Forward Each layer can have 1 machine or many machines. 1 Machine approach: 1 Search head 1 Indexer 1 Forwarder Multiple machines in the search layer: x Search heads in search head cluster (+deployer) 1 Indexer 1 Forwarder Multiple machines in the indxer layer: 1 Search head x indexers in indexer cluster (+cluster master) 1 Forwarder And so on... Search configuration You need to set up a Search head and configure it within the Indexer Cluster, as a Search head. That way, the search head will search in all indexes in the cluster peers. Configuration of search head in Indexer Cluster: http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Enablethesearchhead Forwarder configuration If you would like the indexers in the cluster to balance the arriving data between each other, you need to setup a forwarder that sends the data to both of them in a load-balance manner. Configuration of load balance forward. http://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/Configureloadbalancing ... View more

I'm happy to help the learning process 🙂 There are many approaches to your question. One way of them, we can create new time fields based on the start\end type |eval starttime=if(eventtype="start_job",_time,null()), endtime=if(eventtype="end_job",_time,null()) |stats earliest(starttime) as start lastest(endtime) as end by JobExecID |eval job_status=case(isnull(start),"NOT_STARTED",isnull(end),"NOT_ENDED",true(),"Started-Ended") |convert ctime(start) ctime(end) Overall query: index=main sourcetype=app-gmr eventtype=start_job OR eventtype=end_job | table _time ssnservice eventtype jobId JobExecID | join jobId [ search index=ssn sourcetype=app-gmr INFO job read was already scheduled | rex field=_raw "\]: {} (?.*) with id (?\d+) " ] |eval starttime=if(eventtype="start_job",_time,null()), endtime=if(eventtype="end_job",_time,null()) |stats earliest(starttime) as start lastest(endtime) as end by JobExecID |eval job_status=case(isnull(start),"NOT_STARTED",isnull(end),"NOT_ENDED",true(),"Started-Ended") |convert ctime(start) ctime(end) ... View more