Hi @pacifikn  To start with can you check in splunkd.log (/opt/splunkforwarder/var/log/splunk/splunkd.log) and see what is happening when you start service? there may be several reasons for it's  failure also check if you have any filesystem full etc.,  ... View more

@subramanianers I guess it's something to do with the IAM role attached to your EC2 instance.  you can try removing it and attach new IAM role and see if that works ? ... View more

@ppanchal See if the below logic helps!! | makeresults | eval site="1,2,3" | makemv site delim="," | mvexpand site | appendcols [| makeresults | eval site1="4,3,5" | makemv site1 delim="," | mvexpand site1] | eventstats values(site1) as site2 | eval val=if(in(site,site2),"YES","NO") ============================ index=support source=sites earliest=-1d@d latest=-0d@d | rename site as site1 | table site1 | appendcols [search index=support source=sites earliest=-0d@d latest=now | rename site as site2 | table site2] |eventstats values(site2) as site2_values | eval present_in_both=if(in(site1,site2_values),"YES","NO") ... View more

@999balaji9  You can do it using format->Color option.. refer below screenshot       ... View more

I am facing duplicates though I have changed my local.meta file [test_json] AUTO_KV_JSON = false INDEXED_EXTRACTIONS = json KV_MODE = none local meta  [] access = read : [ * ], write : [ * ] export = system Environment is distributed and I am ingesting this data from Search head. and sample data I tried with  is  https://jsonformatter.org/json-editor/a2ec9f    ... View more

@ac89live No.. I have opened a case with Splunk support. ... View more

@niketn  I am not trying to schedule PDF, I am just trying to export dashboard as PDF using the export PDF option manually, still I don't see the description. I can see all that all other settings works just fine except the description option irrespective of the location we give(left/center/right).  ... View more

Just to add little bit to the @richgalloway 's answer, if you just  need to see the complete list of hosts you could use   | metadata type=hosts index=* | table host  OR  |tstats count where index=* host=* by host  | table host ... View more

@srinivas0704 Could you try index=foo | regex _raw="1\s+ADM\.ADMX\spolicies" if you need to match with 1 ADM.ADMX policies literally but if you need to capture string with any digit at the start you can try with index=foo | regex _raw="\d\s+ADM\.ADMX\spolicies" ... View more

@sudeep5689 Yes, may be 2nd option or 3rd option works for you. If my solution helps, please mark it as answered ... View more

Yes, even when the user has UTC, it's still showing the _time as EDT i.e time in event and _time are not matching ... View more

Hi, There are few ways to perform this, Convert your file based lookup to kvstore, which helps you to change the content easy (https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/ConfigureKVstorelookups) Use lookup editor app to modify contents in the lookup (https://splunkbase.splunk.com/app/1724/) Write a search to modify the contents and update the samelookup |inputlookup abc.csv | <content modify search> | outputlookup abc.csv Your <content modify search> can be something like |eval <fieldname>=if(fieldname=="something","newvalue","oldvalue") etc., to update field such as fieldname values with the new content. Above logic varies based on your requirement, please check eval documentation here (https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/CommonEvalFunctions) ... View more

I agree with @to4kawa you need to use the earliest and latest properties in your searches. You may try using your search below and add values for earliest and latest as per the need, so they both run for same time range index=trace type=success earliest=-7d@d latest= now() | eval temp=split(ip,",") |eval src=mvindex(temp,0) | search [search index=trace type=blocks earliest=-7d@d latest= now() | bin span=10m _time |eval temp=split(ip,",") |eval src=mvindex(temp,0)|stats count by src| where count > 50| fields src] | table _time src route ... View more

@codebuilder I don't see any files older than 2 days in dispatch directory , below is the confirmation from the command Using logging configuration at /SplunkSHEBS/splunk/etc/log-cmdline.cfg. dispatch dir: /SplunkSHEBS/splunk/var/run/splunk/dispatch destination dir: /SplunkSHEBS/splunk/var/run/splunk/old-dispatch-jobs/ earliest mod time: 2020-04-29T03:32:03.000-04:00 total: 1331, moved: 0, failed: 0, remaining: 1331 job directories from /SplunkSHEBS/splunk/var/run/splunk/dispatch to /SplunkSHEBS/splunk/var/run/splunk/old-dispatch-jobs / Also when I use the sid to view the job properties, I don't see the job exists , even if I am searching for the job that was finished a couple of minutes ago and when I run the search query, I don't see any errors Please suggest @woodcock @somesoni2 @MuS @martin_mueller ... View more