In my environment, I've setup the SSL communication and authentication between Deployment Server and its deployment client. It is working fine. The trouble came when nearly 1 year - the renewal of the SSL is needed, meaning the server.pem and cacert.pem in UF require to be updated with renewed SSL.  For the first year, we have used DS to push the SSL cert over to UF. Question is - is there any way to push the second year's SSL cert (server.pem and cacert.pem) over to UF using Deployment servers while the first year SSL still valid? Or is there any best practice how to renew the cert in UF (deployment client) in yearly basis?   Thanks. ... View more

Hello, Assuming I have a role created "myapp_admin_role" and there is a setting for User-level concurrent search jobs limit as 3. This role has inherited another role under Inheritance called "general_admin_role" with User-level concurrent search jobs limit as 10. What is the concurrent search job limit for user in myapp_admin_role? Thanks in advance for the answer. ... View more

Hello, In my environment, I have a long list of ITSI services (created by someone else) which using default KPI base search. These default KPI base search is running every mins for 1 min data and it has causes some impact to the indexers. Without going through the UI for ITSI services and checking the search source for each KPI, is there any query I can use to generate the list of the ITSI services + KPI base search + base search source name? Thanks. ... View more

Hello, I've a field with date/time in it. The field name is system_created_on=2019-04-26 09:38:24. I have a time picker and I would like to use the date selected to compare with a field with date/time. For example, when user select 4/26/2019, I need to have the query to match with"2019-04-26" from system_created_on field. How can I achieve this? Thanks. ... View more

Hi there, I have this query formed and I can't the get expected result, but it's very close to what I want. The result of chart followed by transpose command is looking good, but under "column", I'm getting the value as NULL instead of "sourcetype". May I know how to fix it? index=* sourcetype=* | eval date_hour=if(len(date_hour)==1,"0".date_hour.":00",date_hour.":00") | rex "Total1\:\s(?<total1>[\d+]+)" | rex "Total2\:\s(?<total2>[\d+]+)" | stats count(total1) count(total2) by date_hour | eval granttotal = total1+total2 | fields - _time | chart values(granttotal) over date_hour by sourcetype | transpose header_field=date_hour column 02:00 03:00 04:00 NULL 96.64 80.00 89.70 ... View more

Hi all, I have a simple regex to extract 2 fields — name1 and name2. And I would need to combine it like this: name1.name2 and send it to xyseries as one name. I can't make it work with the below query. | rex "line1\=(?<name1>[\w+]+)" | rex "line2\=(?<name2>[\w+]+)" | eval fullname=name1.name2 | xyseries fullname date_hour count Could someone please help me? Thank you in advance. ... View more

Hi all, I'm trying to find way how to control / customize the bulletin messages that appear on the top menu as "Messages". My issue is everyone having access has visibility of these messages and I would like to control that visibility. Thanks. ... View more

Hi all, I have the distributed environment setup for SH cluster and indexer cluster. Now, I have a standalone server with both SH and indexer configured. My question is how to enable this standalone server to search the data ingested to distributed/clustered environment? I just want to enable the search in standalone server, and I don't want to have the data inside standalone server, and I don't want to add standalone as one of the SH cluster. Is this doable? I'm trying to read the documentation but kind of confusing after reading and I have no idea which document is the right doc for such requirement. Thanks. ... View more

Hello all, I'm facing a challenge in getting the dashboard requirement done. This is reading from the log, the log pattern is like this: 2018/06/14 06:50:51 VCS NOTICE V-16-1-10447 Group virtual_abc is online on system SERVER_A When this string is found (the latest string), it is confirmed that virtual_abc is running in SERVER_A. The requirement is to have the dashboard with SERVER_A and SERVER_B in it. If the virtual_abc running on SERVER_A - it is green for SERVER_A. If the virtual_abc is running on SERVER_B - it is red for SERVER_B (virtual_abc should always running in server_A). I've the below query correctly extracted the string I want, but have no idea how to make it like requirement above. index=* | rex field=_raw "Group virtual_abc is online on system (?<online>[\w+]+)" | stats latest(online) May I ask for your help? ... View more

Hi all, I've successfully create a dashboard with table based on solution given by @niketnilay (https://answers.splunk.com/answers/659499/how-to-expand-table-based-on-click-to-the-column.html) However, I have new problem now. For example in page 3 (table is lengthy), after clicking the xxx % to expand the table column using drilldown feature, the newly loaded table is back to page 1. How to enable the feature to go back to the page where user clicked to expand/drilldown? Thanks. ... View more