Upgrade is not an option for now. furthermore, everything goes OK with DB Connect. it will be upgraded with the whole system. I did ask this question precisely because could not find the checkpoint values persistence files for our enable DB Input in folder: /opt/splunk/var/lib/splunk/modinputs/server/splunk_app_db_connect ... View more

The Documentation link given belongs to DB Connect version 3.15.0 and talks for "Splunk DB Connect version 3.10.0 or higher". Our DB Connect Version is: 3.6.0 When on the doc link I change the DB Connect version to 3.6.0, I receive this: "The topic you've asked to see does not apply to the version you selected. " So it looks documentation tells nothing for backup/restore of DB Connect 3.6.0. Or am I missing something? best regards Altin ... View more

Thank You @Richfez  As a first need (and I should have said this in the opening), I was not asking to access them at all. I just want to know where they are, to backup them just like everything else in /etc/apps folder. But editing them could also be a need, ex: in case of db inputs info  loss of any kind.  And if it be the case, I guess to better edit them (at one's own risk) directly into the OS via a text editor since they are json. regards Altin ... View more

I can have the result with 60 days without changing index retention. I do not know why. But I have to change the -30 days to -60 days in Splunk-owned form that does not allow editing. Guess I will keep this in mind and see if Splunk will change any thing in the coming versions. best regards Altin ... View more

Further more, if I "open In search" the search code of the two dashboards, and change every occurrence of -30d@d to -60d@d, and search, there will be 60 bars - last 60 days. This happens although the frozenTimePeriodInSec = 2592000 (30 days) for index _internal. Do we really need to double this setting? It looks that just changing -30d@d to -60d@d,  is enough. best regards Altin ... View more

But this form has no Edit button. Which means it is not meant to be modified other then by Splunk itself. ... View more

Thank You very much @gcusello  OK that I go for _internal retention from 30 to 60 days. But when I open - "Open In Search" - the two first dashboards, the code is as below Daily License Usage index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | dedup _time stack | stats sum(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] Percentage of Daily License Quota Used index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b latest(stacksz) AS stacksz by slave, pool, _time | stats sum(b) AS volumeB max(stacksz) AS stacksz by _time | eval pctused=round(volumeB/stacksz*100,2) | timechart span=1d max(pctused) AS "% used" fixedrange=false As you see, there are " earliest=-30d@d" in both of them, two in the first dashboard and one in the second. I guess I need to set those to " earliest=-60d@d".  Otherwise, extending the retention to 60 days, would have any value ? best regards Altin ... View more

Is it a problem if I modify it directly under the defaul folder? Is a restart needed after ? best regards Altin ... View more

I do have data on my _internal index for much longer then. At least from sourcetype splunkd ... View more

This is a Splunk's form, not mine, not of any third party app (be this Splunk supported). If a label on a form says last 60 days, then the respective dashboards should be showing the last 60 days - ad not less. Ps. at my _internal index there are data much earlier then 30 days. Ex. can search data from early November 2023. Didn't try earlier. regards Altin ... View more

One last question: Is my request kind of "monetize your content" like in the link below: https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Splunkbase/Monetizeyourcontent  ... which now leads to a "Hi! This page does not exist, or has been removed from the documentation. " ? Am I looking to something that was previously supported, but now is not? More: quoted: "you can add a license for a third party solution to your Splunk instance and have Splunk enforce it" I am not looking per force to " have Splunk enforce it". If I could do it just within my App that would be fine. Can this be done ? best regards Altin ... View more

Hi @kmorris_splunk  I have the same issue. The link provided leads to an empty page: "Hi! This page does not exist, or has been removed from the documentation. ....." best regards Altin ... View more

Thank you very much @isoutamo . I did understand that such application must be hosted outside Splunkbase, but can be referenced from there. But what about how to do the trial-expiry (my main concern)? I have searched a lot but did not found anything related. best regards Altin ... View more

Thank You very much @richgalloway  As You suggested, the following worked: index = os_sysmon NOT Image="*Sysmon*" EventCode=1 | rex field=Image "(?P<Executable>[^\\\]+)$" | table Image Executable ... View more

thank you @richgalloway  for the reply attached is an example of my search ... View more

Thank you very much for the solution regards Altin ps. upvote is "accept as solution"? ... View more

Thank you for your answer too   regards Altin ... View more

I am not getting: Why makeresults should be there I have an existing field "statement" from which I need to get the IP, instead of a _raw one Do not understand part "rename comment .." - I have no field named "comment" referring to part  eval raw="[CLIENT: 192.20.21.22]" part 192.20.21.22 is NOT fixed,  it is just from the example above, it is variable - what I want to get as field IP2 regards Altin ... View more