Good Morning, I am running into an issue where my two newest Server 2022 endpoints have events that are showing up non-XML, whereas all my other endpoints are outputting in XML. I have renderXml=true in the inputs.conf and the inputs.conf files in the Splunk_TA_windows are the same for each endpoint. I can't find the difference causing this. One thing I have learned through this is that I may prefer non-XML so if these two endpoints are not respecting renderXml=true, how do I know all the others will respect the false value to match them all up? Is there somewhere overriding this? I have not edited any \etc\system\default\inputs.conf files. They're all in local or an app. Thank you in advance! Edit: I am on Splunk Cloud. Scott ... View more

Good Afternoon, I have a query to get disk space from servers. Each server has between 1 and 3 drives. My query will output a list of all Hosts, Drives, Times and Free Space % but the results are for the last minute and show all results for each host in that minute (several each). Is there a way to limit the results to UP TO 3 per host? If I "dedup 3" it creates 3 for the hosts that have 1 or 2 drives. Thank you!     (index=main) sourcetype=perfmon:LogicalDisk instance!=_Total instance!=Harddisk* | eval FreePct-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(),true(),storage_free_percent), FreeMB-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(), true(),Free_Megabytes), FreePct-{instance}=storage_free_percent,FreeMB-{instance}=Free_Megabytes| search counter="% Free Space" | eval Time=strftime (_time,"%Y-%m-%d %H:%M:%S") | table Time, host, instance, Value | eval Value=round(Value,0) | rename Value AS "Free%" | rename instance AS "Drive" | rename host AS "Host"       ... View more

Hello Splunkers, I am attempting to gather the free disk space of all servers and create a report / alert based on it. Thus far I have the SPL set so it outputs the Time, Host, Drive and % Free but the results come back in a long list of pages. What I'd like to do is two-fold. First part is getting one result per Drive, so one result for each drive on a host and then I'd like to set up an alert for low disk space. Here's my SPL so far:   (index=main) sourcetype=perfmon:LogicalDisk instance!=_Total instance!=Harddisk* | eval FreePct-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(),true(),storage_free_percent), FreeMB-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(), true(),Free_Megabytes), FreePct-{instance}=storage_free_percent,FreeMB-{instance}=Free_Megabytes| search counter="% Free Space" | eval Time=strftime (_time,"%Y-%m-%d %H:%M:%S") | table Time, host, instance, Value | eval Value=round(Value,0) | rename Value AS "Free%" | rename instance AS "Drive" | rename host AS "Host"     The result is:    ... View more

We are attempting to use Alert Manager as a way to maintain an audit trail. We open cases and note them before closing but there are some that we'd want to auto suppress. I'm sure I'm missing something simple here hence the post. The page in Alert Manager says: Usage Use "$result.fieldname$" (without quotes) to refer to a field from results. Can either be used in "field" or "value" Use "$fieldname$" (without quotes) to refer to a metadata field, such as "$title$". Can either be used in "field" or "value" Use "_time" (without quotes) in "field" to compare the incident timestamp against a value (e.g. for maintenance windows) Note: All of the rules configure must be true for a valid suppression.   If I try to just put $title$ in the field space and specify a title, nothing gets suppressed. Do I need to use different language / arguments here? Thank you in advance.     ... View more

I cannot seem to get more than myself and Unassigned for users in Alert Manager. If I switch from "Builtin" to "alert_manager" it will still say Both. The install info for Alert Manager mentions typing in alert_manager users but I have nowhere to type these. I did see an older thread from 2018 where the person mentioned inheritance and roles but I couldn't make sense of it. Any help is appreciated, thank you!     ... View more