@Alankrit- Below is the search you can use. But just to clarify few points: This search is not very efficient and do not meant for reporting and only meant for troubleshooting purposes so you can find the source of duplicate events. index=* sourcetype=* host=* | stats count by index, sourcetype, host, _raw | where count>1   I hope this helps!!! Kindly upvote if it does!!! ... View more

As of today here where I think it is: Login to Splunk.com Under the menu there is option for Support > Support Portal Under the menu there is Get Started > Certifications You should see the certificates here. Also, you can find them on Credly if you have connected it properly.   I hope this helps!!!! ... View more

@MK3- I believe its an permission and/or app-context issue. When you create service object, Provide the same username you use to login on Splunk UI Provide the same App name which you use on UI and search works fine service = client.connect(host="<ip/hostname>", username="<username>", password="<user-passwd", app="<same app as you use on UI>")   I hope this helps!!!! ... View more

@ab73863- Try this approach with sessionKey. Specify Splunk Cloud URL and port number should be 8089 but you can confirm with your Splunk Cloud Representative or Splunk Cloud Support.   I hope this helps!!! ... View more

@Nawab- The answer is yes, you can setup SSL on both places and you can also set SSL only for HF to Indexer. I think it should not matter what you use from UF to HF and HF to Indexer, they should act independent from each other.   Connection with SSL   inputs.conf --------------- [splunktcp-ssl:9997] serverCert = <string> sslPassword = <string> requireClientCert = <boolean> sslVersions = <string> cipherSuite = <cipher suite string> ecdhCurves = <comma separated list of ec curves> dhFile = <string> allowSslRenegotiation = <boolean> sslQuietShutdown = <boolean> sslCommonNameToCheck = <commonName1>, <commonName2>, ... sslAltNameToCheck = <alternateName1>, <alternateName2>, ... useSSLCompression = <boolean> outputs.conf ------------------ [tcpout] defaultGroup = my_indexers [tcpout:my_indexers] server = <indexer>:9997 sslPassword = password clientCert = $SPLUNK_HOME/etc/auth/server.pem (<Check outputs.conf.spec for other SSL configs)     Connection without SSL   inputs.conf --------------- [splunktcp:9997] outputs.conf ------------------ [tcpout] defaultGroup = my_indexers [tcpout:my_indexers] server = <indexer>:9997     I hope this helps!!!! ... View more

@Siddharthnegi- I'm saying not to change, change just to see if it works or not. And this will tell you if that also does not work meaning, its the issue with how you are editing the file or the file location or something like that. I asked just to validate whether its the issue with how you are editing the file or a Splunk bug.   I hope this helps!!! ... View more

@Siddharthnegi- Two things I would say to check: Restart Splunk and check. Use "My Reports" instead of "Reports" and check. (Do restart Splunk if you are updating the XML from backend. And ensure you are updating on the right server.)   I hope this helps!!!! ... View more

@kwiki- You are on the right track on using streamstats.  But I would just run two searches and compare the results, it would be much easier to write query for. Here it is: index=myindex sourcetype=trans response_code!=00 earliest=-3d@d latest=-2d@d | stats count as error_count_3_days_ago | append [| search index=myindex sourcetype=trans response_code!=00 earliest=-2d@d latest=-1d@d | stats count as error_count_2_days_ago] | stats first(*) as * | eval perc_increase = (error_count_2_days_ago-error_count_3_days_ago) / error_count_3_days_ago)*100, 2) | where perc_increase>3 | table perc_increase ( I have not tested the query, but logic is to append data data together and compare)   I hope this helps!!!! ... View more

@nivets- Question has paradox. Do you want to change the time-range or not change the timerange? ... View more

No.   Let me explain with example. Event with timestamp 3:14 comes at 3:17 Event with timestamp 3:15 comes at 3:18 That means if you make a search at 3:18 with earliest=-2m@m latest=now This means it will search event between 3:16 to 3:18 Locally this will not include any events, never. Because events are always 3 minutes delay. Solution is to never search last 3 minutes when writing search and wait for those events to populate in the next schedule with: earliest=-63m@m latest=-3m@m OR earliest=13m@m latest=-3m@m OR earliest can be anything but keep the latest in a way that it never search recent events, to keep events being missed issue.   There is another solution as well with _index_earliest and _index_latest, but that's topic for another time. (a bit complicated)   I hope this helps!! ... View more

@dkmcclory- It depends on what your API call does. If your API call collects data and ingest into Splunk, then use Input else use scheduled alert/report. ... View more

@zapping575- This is little-bit complicated topic, as there are many ways to achieve this and also there are many types of Rest endpoints. I prefer to learn from example, some prefer to learn from documents. I'm putting both as references here: https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/ https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/customrestscript/ https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/customrestmanageaccess/ https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/customresteai/ https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/creexamples/ https://github.com/splunk/splunk-app-examples/tree/master/custom_endpoints/hello-world   I hope this helps!!! ... View more

@dkmcclory- There are 2 generic ways Splunk App developer uses to schedule things: Inputs Alerts OR Scheduled Report   Input is usually used when you would like to collect data on scheduled basis.   For other use-cases you can use Scheduled Report or Alert. And you can schedule alert and report with a Cron Job. If something you do as Splunk query, then you can just write query in this alert or report. If something you need custom Python code, then you can write a Python Custom command which you can call from Splunk query.   Reference for custom Splunk command: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/ https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/ https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/customsearchcmdexamples/   I hope this helps!!! Please upvote if it does!!! ... View more

Glad you figured it out!!! ... View more

@user487596- I have same result for client info, it feels like this is how it designs. But I feel having actual IP would help. For username, in some events I do see actual username in my case. In some events it is "-". ... View more

@Prajapati- Please put the question along with details for question that is not directly related to the core Splunk Enterprise (ex. here question is related to some third-party integration for Virus-Total) so that people on the community can help. I have also moved your question to right board of the community. ... View more

For all the Apps if the document is present then it should be there in one of the tab in Splunkbase page itself. ... View more

@anglewwb35- I'm not sure what kind of integration are you trying to do. But here is the references for Splunk API, which I hope will help you build the integration.   https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTUM/RESTusing https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTprolog ... View more

@ivarny- I'm able to access the Doc, not sure what's wrong your machine. Try a different browser maybe. ... View more

@egt- This is not complete stack-trace to provide the information what is the root cause of this error. Regarding the slowness of the system, it all usually boils down to machines capability. Please check the resource availability of the system - CPU, Memory, Network   I hope this helps!!! ... View more

@umeshchandra- Even though you are using SAML authentication, you can still create a local Splunk service account (with right read-only permissions) for this job. And it should do the job for your use-case.   I hope this helps!!! ... View more

@sputre- The Add-on documentation describes the API - https://docs.splunk.com/Documentation/AddOns/released/NetApp/Lookups (But I personally have no experience with it)   I hope this helps!!! ... View more

@BisHop1020- Are you talking about this add-on - https://splunkbase.splunk.com/app/6135 This App is archived and I would not recommend using it.   If purpose of using this Add-on is to collect data from Jamf pro? Is so, then you can use - https://splunkbase.splunk.com/app/4729   I hope this helps!!! ... View more

@nsxlogging- I know Splunkbase was under maintenance recently. Try again and if the issue persist then you can contact splunkbase-admin@splunk.com.   I hope this helps!!! ... View more

@n3wbi3- Have you configured DMC (Monitoring Console) roles for all the servers properly? https://docs.splunk.com/Documentation/Splunk/9.2.1/DMC/Configureindistributedmode   Try running: | rest splunk_server_group=* /services/licenser/pools   I hope this helps!!! ... View more