Hi, It is possible that Splunk is running as administrator and you are not part of that group. Please check the services to identify which user Splunk running as. Also, you can open the command prompt with run as administrator and access Splunk folders on CLI. ... View more

Please try with SHOULD_LINEMERGE = false   ... View more

Did you create an Airbnb2 index while uploading data? You can verify in the settings->indexes, if it is being created or not. If not, you can create it while uploading the data. Refer to this documentation: https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Modifyinputsettings#Index ... View more

Please try with the different browser other than internet explorer. As the 8.0.4 version of Splunk only supports The latest versions of Chrome, Firefox, and Safari browsers.  Here is the documentation for the reference: https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchTutorial/Systemrequirements ... View more

Hi Ashvini, Here is the Splunk document which you can refer to, they also give some examples which will help to understand better. https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/CustomAlertConvertScripted ... View more

You need to look at two files status_overview.css and status_overview.js at "/opt/splunk/etc/apps/website_monitoring/appserver/static". ... View more

Are you using a free license or enterprise license? ... View more

This may help: https://answers.splunk.com/answers/754566/how-to-compare-two-fields-from-two-different-searc.html ... View more

Hi hazemfarajallah, Try to use Splunk windows add-on from splunkbase. It will have more configuration examples for perform, WMI etc for windows operating system counters. Refer to this documentation for more details. ... View more

ok. and what is the indexer's timezone? Also, In props.conf put TZ= Asia/Jerusalem . ... View more

What is the data source for this logs? If this are access logs then try to use splunk predefined sourcetypes. ... View more

Did you set any default timezone for your user? Also, check the system timezone. ... View more

@pratapa could you try sending manual email from search command? Check if user getting an email for the same. ... View more

This may help you: index=_audit action=search search=* sourcetype=audittrail | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)" | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | search IndexUsed=* OR SourcetypeUsed=* | fillnull value="NA" IndexUsed SourcetypeUsed| stats count by IndexUsed SourcetypeUsed The count represents a number of searches execution that are using that index/sourcetype. ... View more