Hi @u_m1580 , you could create an alert using a simple search index=<your_index>  that triggers if you have no events. If you need to check a list of hosts, it's different. Ciao. Giuseppe ... View more

Hi @AJH2000 , have you a stand-alone server or a distributed architecture? if a stand alone server you should see all the indexes. If instead, you have a distributed architecture and you are working on the Search Head, you don't see all the indexes in the Indexers. The easiest approach is to add an empty index also on the Search Head, only to see this index in the dropdown lists. Ciao. Giuseppe ... View more

Hi @ws , the best approach is: remove every input that sends logs to this index, in Cluster Manager, put the retention (frozenTimePeriodInSecs) of this index to zero and push the configuration to Indexers, after some minute, check that there isn't any log in the index, then remove the index from the Cluster Manager and push again the configuration. Ciao. Giuseppe ... View more

hi @Cheng2Ready , if you need help, open a new post so more people in Community will be able to help you. Anyway, start checking what's the condition that fails: if the lookup or the weekday, and then check if it fails every time or some times, and if sometimes, when, As secondary test, check if it's a border condition: e.g. if the event has timestamp at 23:59:59 or 00:00:00. Ciao. Giuseppe ... View more

Hi @uagraw01 , you forgot to remove the time tokens: <earliest>$TimeTokenMiddle.earliest$</earliest> <latest>$TimeTokenMiddle.latest$</latest> in many rows of your dashboards, replacing them with a value for the time window. Ciao. Giuseppe   ... View more

Hi @uagraw01 , could you share the code of your dashboard? Ciaol. Giuseppe ... View more

Hi @uagraw01 , it's possible to schedule a pdf containing the form only if in the form there isn't any input. Remove all your inputs and the pdf schedule option will be available. Ciao. Giuseppe ... View more

Hi @danielbb , instead a scheduled report, use an alert that fires if results is greater than 0. Ciao. Giuseppe ... View more

Hi @danielbb , could you better describe your request? are you speaking of Splunk Enterprise or Enterprise Security? ciao. Giuseppe ... View more

Hi @sudha_krish , I'm not sure that's possible to forward logs to a third party using http, the usual way is syslog as described at https://docs.splunk.com/Documentation/SplunkCloud/9.3.2411/Forwarding/Forwarddatatothird-partysystemsd Anyway, http requires to use a token, did you created a token in the receiver? did you enabled it? did you passed it ot your output' Ciao. Giuseppe ... View more

Hi @hazardoom , it's always a bad practice maintain objects in private folders, the only way, is to move them in the app. Ciao. Giuseppe ... View more

Hi @Alan_Chan , this transformation is unuseful on the SH, but it must be localized in the first HF that dara pass trhough, are you sure that you applied it in the first HF? Then check if the sourcetype where you associated the SEDCMD command is the correct one, and that there isn't any transformation on this sourcetype. Then, are you sure that is useful to remove these few chars? Ciao. Giuseppe ... View more

Hi @kunalsingh , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @kunalsingh , please try this: \^([^\=]+)=([^\^]*) Ciao. Giuseppe ... View more

Hi @SPL_Dummy , no, you can set the rendexXml option true or false for an input and not for a part of it. To use this Correlation Search, create a new one clonit it and modifying the sourcetype contained in the macros. Ciao. Giuseppe ... View more

Hi @Cheng2Ready , you run your alert Monday-Friday, and you filter your results using the above search in this way you will not have results in those days so the alert will not fire. Ciao. Giuseppe ... View more

Hi @MatheoCaneva1 , if you have 3 Indexers (IDX), 1 Search Head (SH), 1 Heavy Forwarder (HF) and server with many roles: you should check this last one is also the Cluster Manager, in other words, if you have an Indexer Cluster, even if it's strange that you don't know if you have it! You can check this accessing this server and viewing in [Settings > Indexer Cluster]: in this dashboard, you can see if you have an Indexer Cluster and its status. About the Search Head Cluster, you surely haven't it because you have only one SH (at least three SHs are required!). The SHCD is the Search Head Cluster Deployer, a machine delegated to manage Search Head Clusters, but you haven't a Search Head Cluster so you haven't it. Distributed Search isn't a Splunk role, probably you mean Deployment Server, to manage Forwarders and eventually Search Heads (if you haven't a Cluster). Summarizing: if you have an Indexer Cluster, you have to upgrade your servers following this order: Cluster Manager (that's also DS, LM, MC) SH IDX, HF UF If you haven't an Indexer Cluster: SH IDX, DS, LM, MC,  HF UF At least I hint to read this document that describes Splunk Architectures, to understand your one: https://docs.splunk.com/Documentation/SVA/current/Architectures/About  Ciao. Giuseppe ... View more

Hi @Cheng2Ready , ok, it's a differenty solution and it's ok. about your search, you have to decide if you want to use the lookup command (as your original solution) or a subsearch using NOT [...], as my solution, but not the last solution that you shared. I prefer my solution because it's a best practice to move all the possible search conditions in the main search. Ciao. Giuseppe   ... View more

Hi @shoaibalimir , there's a visualization very similar to your one: the Swimline App ( https://splunkbase.splunk.com/app/3708 ). Otherwise, you could create a dashboard containing many panels, one for each region, but I'm not sure that it can be dinamic. Ciao. Giuseppe ... View more

Hi @chrisitanmoleck , did you try to configure the Default Timezone for your User (in Account Setings)? Ciao. Giuseppe ... View more

hi @becksyboy , are you using the CrowdStrike Falcon FileVantage Technical Add-On ( https://splunkbase.splunk.com/app/7090 )? if yes, this add-on should be already CIM compliant, but it isn.t true because in the add-on there isn't tags.conf and eventtypes.conf. Anyway, I usually use to normalize data the SA-CIM_vladiator app ( https://splunkbase.splunk.com/app/2968 ) , that guides you in the normalization activity. Ciao. Giuseppe ... View more

Hi @chrisitanmoleck , ad first check, verify the timezone of the forwarder. Ciao. Giuseppe ... View more

Hi @hazardoom , 7k alerts aren't upgradable, in this case, the only way, is to move them in the default folder. Ciao. Giuseppe ... View more