I stumbled across this while seeking a solution this week. I came up with something pretty similar to @patrickp_splunk . With a slight change. I kicked things into json before it comes out of the map command (because `map` only allowed me to bring back one field). | datamodelsimple \ | map maxsearches=500 search="| tstats count FROM datamodel=$datamodel$ | eval dmName=\"$datamodel$\" | tojson | fields - count,dmName" | extract | table dmName,count   ... View more

You should ask clarification from doc team. Just leave a comment o that document page and the will be back to you later. ... View more

Thanks for your response, @richgalloway . I will do so. ... View more

In addition you can use these searches to benchmark iowait performance over time, so you can set relevant thresholds for your environment. Just replace the hostname: CPU IOwait average index=_internal  source="*/splunk/var/log/splunk/health.log"   feature=IOWait component=PeriodicHealthReporter node_type=indicator indicator=avg_cpu__max_perc_last_3m host=ind0* | timechart span=30s max(measured_value) min(due_to_threshold_value) by host CPU IOwait single CPU index=_internal  source="*/splunk/var/log/splunk/health.log"   feature=IOWait component=PeriodicHealthReporter node_type=indicator indicator=single_cpu__max_perc_last_3m host=ind0* | timechart span=300s max(measured_value) min(due_to_threshold_value) by host CPU IOwait top3 CPU index=_internal  source="*/splunk/var/log/splunk/health.log"   feature=IOWait component=PeriodicHealthReporter node_type=indicator indicator=sum_top3_cpu_percs__max_last_3m host=ind0* | timechart span=30s max(measured_value) min(due_to_threshold_value) by host   ... View more

Hi here https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers is the current matrix. r. Ismo ... View more

That did the trick. Thank you!! ... View more

I am not sure how those settings got there, but the way that I got those errors was: 1) Install Splunk Universal Forwarder at version 8.2.5. 2) Upgrade Splunk Universal Forwarder to 9.0.0.1. I just redid it and on start up of the Forwarder, I get these messages: Invalid key in stanza [webhook] in /opt/splunkforwarder/etc/system/default/alert_actions.conf, line 229: enable_allowlist (value: false). Invalid key in stanza [provider:splunk] in /opt/splunkforwarder/etc/system/default/federated.conf, line 20: mode (value: standard). Invalid key in stanza [general] in /opt/splunkforwarder/etc/system/default/federated.conf, line 23: needs_consent (value: true). I will take out the weird configurations, but this is kind-of to help others, if they get the same results. ... View more

@woodcock    I have been dragging though a ton of these threads trying to find a simple way to fix how my field _time output information.  I just wanted the date, so I took off the time aspect of your command and BOOM. Thank you. | rename _time AS Date | fieldformat Date = strftime(Date, "%Y-%m-%d") Output: Date 2021-10-01 ... View more

Thanks for posting this - this worked perfectly for me. ... View more

I am current running in my personal box, the splunk enterprise free license and I am able to run searches. You have to login with admin user to be able to run the search from CLI. Try something like this: ./splunk search 'index=main' -index_earliest -5m@m -index_latest @m I believe what is missing is the "-index_latest " parameter check this link with the commands/syntax: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/CLIsearchsyntax#Examples ... View more

Did you fix this issue? I am getting the same on my Search Head Cluster. ... View more

Ooooh. I feel a proper fool, now! ... View more

I am seeing this across the whole of my Splunk ES 5.1.1/7.1.2 system - what version are you using, paddygriffin? ... View more

There is a version drop down on the right side of the app download page, https://splunkbase.splunk.com/app/1293/#/details did you try any of the older versions. Like 2.1.0 was released in Sept 2015. When was 8.1.4 released? ... View more

I just had a thought., What happens when you do the following query? sourcetype="csv" earliest=-10y latest=+10y Do you get anything then? ... View more

Like this: /opt/splunk/bin/splunk cmd btool props list msi_install_logs --debug ... View more

I understand. However, I did not want others to pick that up as an answer and run with it and get into trouble themselves, especially as someone else had already marked it as an answer (and the corrections were subtle when they were applied). I also attached a reason/comment to it, too. I would not have downvoted it if someone else had not upvoted it already. I have upvoted the answer since. ... View more

Yes, after your run btprobe...-reset at UF, and restart the UF, without changing anything in inputs.conf at UF, UF re-monitor the file. Indexer does not know events were indexed in the past. So, indexer simply indexes any data coming from UF. ... View more

Good enough for me... I am getting rid of it on the Indexers. ... View more

awesome 🙂 many thanks for reporting this back - saves my day 😉 ... View more