Hi @pacifikn  To start with can you check in splunkd.log (/ opt/splunkforwarder/var/log/splunk/splunkd.log) and see what is happening when you start service? there may be several reasons for it's  failure also check if you have any filesystem full etc.,  ... View more

@subramanianers I guess it's something to do with the IAM role attached to your EC2 instance.  you can try removing it and attach new IAM role and see if that works ? ... View more

@ppanchal See if the below logic helps!! | makeresults | eval site="1,2,3" | makemv site delim="," | mvexpand site | appendcols [| makeresults | eval site1="4,3,5" | makemv site1 delim="," | mvexpand site1] | eventstats values(site1) as site2 | eval val=if(in(site,site2),"YES","NO") ============================ index=support source=sites earliest=-1d@d latest=-0d@d | rename site as site1 | table site1 | appendcols [search index=support source=sites earliest=-0d@d latest=now | rename site as site2 | table site2] |eventstats values(site2) as site2_values | eval present_in_both=if(in(site1,site2_values),"YES","NO") ... View more

@999balaji9  You can do it using format->Color option.. refer below screenshot       ... View more

@ac89live No.. I have opened a case with Splunk support. ... View more

@niketnilay  I am not trying to schedule PDF, I am just trying to export dashboard as PDF using the export PDF option manually, still I don't see the description. I can see all that all other settings works just fine except the description option irrespective of the location we give(left/center/right).  ... View more

@srinivas0704 Could you try index=foo | regex _raw="1\s+ADM\.ADMX\spolicies" if you need to match with 1 ADM.ADMX policies literally but if you need to capture string with any digit at the start you can try with index=foo | regex _raw="\d\s+ADM\.ADMX\spolicies" ... View more

@sudeep5689 Yes, may be 2nd option or 3rd option works for you. If my solution helps, please mark it as answered ... View more

Yes, even when the user has UTC, it's still showing the _time as EDT i.e time in event and _time are not matching ... View more

Hi, There are few ways to perform this, Convert your file based lookup to kvstore, which helps you to change the content easy (https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/ConfigureKVstorelookups) Use lookup editor app to modify contents in the lookup (https://splunkbase.splunk.com/app/1724/) Write a search to modify the contents and update the samelookup |inputlookup abc.csv | <content modify search> | outputlookup abc.csv Your <content modify search> can be something like |eval <fieldname>=if(fieldname=="something","newvalue","oldvalue") etc., to update field such as fieldname values with the new content. Above logic varies based on your requirement, please check eval documentation here (https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/CommonEvalFunctions) ... View more

@codebuilder I don't see any files older than 2 days in dispatch directory , below is the confirmation from the command Using logging configuration at /SplunkSHEBS/splunk/etc/log-cmdline.cfg. dispatch dir: /SplunkSHEBS/splunk/var/run/splunk/dispatch destination dir: /SplunkSHEBS/splunk/var/run/splunk/old-dispatch-jobs/ earliest mod time: 2020-04-29T03:32:03.000-04:00 total: 1331, moved: 0, failed: 0, remaining: 1331 job directories from /SplunkSHEBS/splunk/var/run/splunk/dispatch to /SplunkSHEBS/splunk/var/run/splunk/old-dispatch-jobs / Also when I use the sid to view the job properties, I don't see the job exists , even if I am searching for the job that was finished a couple of minutes ago and when I run the search query, I don't see any errors Please suggest @woodcock @somesoni2 @MuS @martin_mueller ... View more