We have that false positives lately too and we found out with helkp of the following search that our peers ran into authTokenConnectionTimeout which defaults to 5 seconds authTokenConnectionTimeout is located in distsearch.conf       index=_internal (GetRemoteAuthToken OR DistributedPeer OR DistributedPeerManager) source!="/opt/splunk/var/log/splunk/remote_searches.log" | rex field=_raw "Peer:(?<peer>\S+)" | rex field=_raw "peer: (?<peer>\S+)" | rex field=_raw "uri=(?<peer>\S+)" | eval peer = replace(peer, "https://", "") | rex field=_raw "\d+-\d+-\d+\s+\d+:\d+:\d+.\d+\s+\S+\s+(?<loglevel>\S+)\s+(?<process>\S+)" | rex field=_raw "\] - (?<logMsg>.+)" | reverse | eval time=strftime(_time, "%d.%m.%Y %H:%M:%S.%Q") | bin span=1d _time | stats list(*) as * by peer _time | table peer time loglevel process logMsg     ... View more

I am making one assumption: 1. In the second condition you have provided, your host values are comma delimited (when they both come together). Going by this assumption, I suggest you use a lookup to prepopulate the email ids based on host names and then call another splunk command sendemail . Here is a sample one: | makeresults | eval host="a,b" | makemv host delim="," | mvexpand host| lookup emaillist host as HOST OUTPUT email as EMAIL| sendemail to=EMAIL Here even if your host value is only a or only b, it should still work. Lookup helps you managing the email ids without touching the query. However, you can also put some if-else logic in the query to get this done. But that may require changes in query, even if you want to update any spelling. Let me know if this helps. ... View more

Hi @niketnilay I'm stucked at same kind of scenario, how we can pass input/value to system variables (Dev1,Dev2,Dev3, Test1,Test2,Test3 ,Prod1,Prod2,Prod3) . I have posted question, and it somehow related to it, could you please assist here? https://answers.splunk.com/answers/780873/multivalve-drilldown-and-dropdown-is-not-working-i.html link text ... View more

Settings -> Event types -> New Event Type Be sure to set the Tag(s) settings. ... View more

Hi Reach, Try this, Go toSettings -> Searches, Reports and Alerts. Find the scheduled search driving the alert in there, Click on edit and the delete/disable/modify the alert. Let me know if this helps. ... View more

This is a similar case and maybe useful for you. https://answers.splunk.com/answers/53161/alert-when-a-host-exceeds-a-certain-number-of-messages-per-minute.html ... View more

Wierd it works with out quotes for you .. but we should keep the value in double quotes to work.. | eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid. | eval client_ip="192.162.207.160" - works fine ... View more

Hi, Try This run search anywhere | makeresults | eval data="Field1|Value1|Field2|Value2|" | rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|" or base search | rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|" ... View more

you can add _time to the by clause in your tstats command to bucket the data over time. I'm not sure what your lookup does exactly and/or if you really need a list of indexes in the results, but maybe this will point you in the right direction | tstats count by index _time span=1h . . . | timechart span=1h sum(count) as count by field1 ... View more

I tried this before but for the sparkline it shows a flat line with 0 value all across. ... View more

have you tried this: | eventcount summarize=false index=* ... View more

Thank you for your reply. In our Splunk environment we have SHC, Indexer Cluster and Heavy Forwarders. We have the HEC port 8088 running only on the Heavy Forwarders. The Documentation for this App is not very clear. Where do I install this App on i.e., on SHC/Indexer Cluster/Heavy Forwarders. Also this App requires HEC setup on the Splunk system, so where do I setup HEC. ... View more