Hi Experts, Has any one achieved SNMP polling to network device from redhat based Splunk HF. Trying to follow below documentation but end up getting some errors related to data bases and connections. Collect data with input plugins | Telegraf Documentation ... View more

Hi Folks,   currently we have 4 physical indexers running on CentOS but since CentOS is EOL , plan it to migrate OS from CentOS to Redhat on same physical nodes.  Cluster master is a VM and already running on Redhat. so we will not be touching CM. What should be the approach here and how should we plan this activity ? Any high level steps would be highly recommended. ... View more

Recently I have created a KVlookup using transforms .conf and collection.conf to get data from API. When KVlookup is manually opened, we can see the data but when searching on search head using inputlookup, it doesn't show anything. Permissions has also been granted. Is there anything else, which we are missing? ... View more

Is any one using Alert manager 3.x on Splunk ES 8.x and is it working properly.   we tried upgrading alert manager from 2.2 to 3.1 on Splunk ES 8.1 but its not working properly ( Alert are not getting converted from "new" to "auto_assigned" . After checking with Splunk they are recommending to migrate from "Alert manager" to "Alert manager Enterprise".   Can some one suggest on this please? Thanks ... View more

Requirement is to fetch values for all agentName and put it in a field.   Tried - 'agentName':\s(?<agentname>.*?,) but it pulls only first occurence.  Below is sample:   0,1,"[{'active': 0, 'metricsAtStart': 'Jitter: 193.6 ms', 'metricsAtEnd': 'Jitter: 98.8 ms', 'agentId': 280961, 'agentName': 'BR15CORPTE01', 'dateStart': '2023-07-19 18:27:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=280961'}, {'active': 0, 'metricsAtStart': 'Jitter: 194.2 ms', 'metricsAtEnd': 'Jitter: 1.9 ms', 'agentId': 294526, 'agentName': 'US06CORPTE01', 'dateStart': '2023-07-19 18:23:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294526'}, {'active': 1, 'metricsAtStart': 'Jitter: 100.2 ms', 'metricsAtEnd': '', 'agentId': 294566, 'agentName': 'US22CORPTE01', 'dateStart': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294566'}, {'active': 0, 'metricsAtStart': 'Latency: 209 ms', 'metricsAtEnd': 'Latency: 142.9 ms', 'agentId': 337436, 'agentName': 'AR06CORPTE01', 'dateStart': '2023-07-19 18:26:00', 'dateEnd': '2023-07-19 18:27:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=337436'}]",194913203,2023-07-19 18:22:00,"[{'rel': 'related', 'href': 'https://api.thousandeyes.com/v6/tests/3271565'}, {'rel': 'data', 'href': 'https://api.thousandeyes.com/v6/net/metrics/3271565'}]",https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203,((avgLatency > ... View more

Hi, I have a lookup table where column names are with weekdays (like monday, tuesday, wednesday,...) and have possible values as 1 and 0 only. What I want to achieve.. ...some query | eval day=strftime(now(),"%A") | where 'day'=1 but this doesn't seems to be working. Any idea how to search dynamic fields.   Thanks ... View more

we have upgraded splunk Enterprise to 8.1 and Alert manager to 3.1.11. After upgrade, alerts are not getting auto assigned and keeps on sitting with "new" status and hence not getting processed.   Any leads to this problem will be appreciated. Thanks ... View more

Any one have used this App. I am trying to download and  configure this app but every time receive "404" error. Below is the link trying to follow: https://docs.splunk.com/Documentation/NetApp/2.1.91/DeployNetapp/InstalltheSplunkAppforNetAppDataONTAP Any assistance please? Thanks Sushant ... View more

Need to monitor a website which when gets hit shows a popup with Username and Password. Tried below possibilities till now. 1. Used Website input App but in "Enter Credentials" page , it throws "Username and Password field name not detected" Error. 2. Tried passing credentials using below but getting unauthorized error. https://URL/insecurelogin?loginType=splunk&username=EMEA\abc&password=XYZ https://URL/insecurelogin?username=EMEA\abc&password=XYZ Any one has done such monitoring , please share your valuable inputs. Thanks ... View more

HI Experts,   we have 4 physical indexers in cluster and since few days /splunk file system storage has reached to threshold on 2 out of 4 indexers. Is there any way to equally distribute the storage load on all of the 4 indexers? Does data rebalancing option help here? ... View more