Short documentation reminder: https://docs.splunk.com/Documentation/DBX/3.18.2/DeployDBX/Prerequisites "KV store must also be active and working properly as of DB Connect version 3.10.0 and higher" ... View more

ES Cannot be installed in a cluster on Windows, it only supports standalone ES search heads. https://docs.splunk.com/Documentation/ES/latest/RN/Limitations ... View more

Hi, Were you able to actually get the logs back or just fixed the issue wherein it did not happen again but the missing logs still remained missing? Thanks. ... View more

Hi @jacobpevans - each of the links should work now, thanks for catching that - it's been fixed! ... View more

Edit: This one should be more accurate and will also let you use the date picker.   index=_internal host="SPLUNK_DS_NAME" component=PubSubSvr event_message="Subscribed*" | eval hostname=mvindex(split(connectionId, "_"), 4) | search hostname!="direct" | eval guid=mvindex(split(connectionId, "_"), 5) | dedup guid sortby +_time | join guid type=inner [search index=_internal host="SPLUNK_DS_NAME" component=PubSubSvr event_message="Subscribed*" earliest=1 | eval hostname=mvindex(split(connectionId, "_"), 4) | search hostname!="direct" | eval guid=mvindex(split(connectionId, "_"), 5) | eval h_time=_time | dedup guid sortby +_time | fields guid, h_time] | addinfo | eval firstSeenDiff=_time-h_time | eval pickerDiff=now()-info_min_time | where pickerDiff>=firstSeenDiff | eval lastSeen=strftime(_time, "%Y-%m-%d %H:%M:%S") | eval firstSeen=strftime(h_time, "%Y-%m-%d %H:%M:%S") | table lastSeen, firstSeen, guid, hostname   This seems to be the earliest date stamp of events, not the forwarder check-in.   index=_internal source=*metrics.log group=tcpin_connections | dedup guid | table _time, guid, hostname   (Simplified version of Solved: Re: Listing forwarders - Splunk Community) I then realized this was just for forwarders sending data. Although it would be strange, you can have forwarders connected to just the DS.   index=_internal host="SPLUNK_DS_HOSTNAME" component=PubSubSvr event_message="Subscribed*" | eval hostname=mvindex(split(connectionId, "_"), 4) | search hostname!="direct" | eval guid=mvindex(split(connectionId, "_"), 5) | dedup guid sortby +_time | table _time, guid, hostname     ... View more

It might be a duplicate question, but the original post you reference does not solve the issue either. Someone from Splunk should explain why users can't have the choice of determining the size of fields they want to accelerate.  ... View more

Try to change the schedule  From  schedule = 0 6 * * * To  schedule = 1800   ... View more

The add-on that gets the data to that index on the 3rd host needs a props correction add TZ = correct time zone field in there and that should fix the time. ... View more

Super helpful! Works great! ... View more

Same issue, try clicking "data summary" under the How to Search tab ... View more

https://github.com/splunk/splunk-aws-project-trumpet#support """ Support Trumpet is currently maintained by nstonesplunk. This is not a Splunk supported solution. """   ... View more

Greetings @naagaraj , The default setting for new Windows Event Logs is to ingest all logs - including historical logs. When you deploy that, it's not surprising that space quickly fills as Splunk handles the backlog.  If you don't want historical logs, take a look at the current_only setting specifically for Windows Event Logs. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Windows_Event_Log_Monitor ... View more

thanx for your reply, but in this Add-on, I did not see the functionality of sending PDF files to telegram. I assume that there is no such addons in the splunk application database. Most likely there are self-written scripts, that's probably for this purpose I wrote 🙂 ... View more

hi @sanjubaba, Check this: https://docs.splunk.com/Documentation/Splunk/8.1.2/Indexer/Setaretirementandarchivingpolicy   ... View more

Greetings @Marco, Take a look at this free, popular splunkbase app: https://splunkbase.splunk.com/app/4182. Everything you need should be in the description. Good luck! ... View more

web.conf if for Splunk Web. In order to use this, your private key must be decrypted. Which means, you are able to verify the certificate using ssl and it doesn't prompt you for a password. But I doubt you need to access your indexer in Splunk Web. When I changed our certificates system-wide these were my notes for Indexers: ---To prevent server from trying to reach Splunk Base for updates-- Etc/system/local/server.conf  [applicationsManagement]  allowInternetAccess = false   ---without this, mongod will fail to start.  [kvstore] serverCert = $SPLUNK_HOME/etc/auth/<servername>/<servername>.pem  sslPassword = <password_of_serverCert>    [sslConfig]  serverCert = $SPLUNK_HOME/etc/auth/<servername>/<servername>_.pem  sslPassword = <password_of_serverCert>  sslRootCAPath = $SPLUNK_HOME/etc/auth/rootca/Root_CA.pem   Etc/system/local/inputs.conf    [SSL]  serverCert = $SPLUNK_HOME/etc/auth/receiver/receiver_cert.pem  sslPassword = <password > sslVersions = -all, tls1.2   Now, if you must access Splunk Web into the indexer: Etc/system/local/web.conf  Note: Splunk Web will not work with encrypted private key. Ensure you are using  decrypted private key and certificate for this configuration.    [settings]  privKeyPath = $SPLUNK_HOME/etc/auth/<servername>/<webServerCert>_webServerCert_priv.key  serverCert = $SPLUNK_HOME/etc/auth/<servername>/< webServerCert>_webServerCert_cert.pem    To export private key decrypted for us in Splunk Web web.conf, you can use the following: Export private key, you will need the pass phrase: openssl rsa -in server_priv.key -out web_server_priv.key you can copy this contents and replace the key on your original servercert.pem and save it as whatever name you like: web_servercert.pem Test your certificate to ensure you are not prompted for passphrase:  openssl rsa -in web_servercert.pem –text (Remember, you will only use this for web.conf, if you try to use this in server.conf - mongod will not start due to no passphrase)   ... View more

That's what I was looking for, Thanks again @jacobpevans  ... View more

hi @jacobpevans  This do the job ! Thanks ! ... View more

Thanks for the quick response again. Are you suggesting that I run the search index=* | table field1 field2 field3 _time and run that every day? I think that would be a very big file. In the past I've taken a timechart query and run it hourly and then loaded it in the panel and appending the current data to it. But that was a specific time period. I don't know how I would be able to do that for when a user picks a custom time period.  Edit: that would actually work for a timechart. disregard that. How would I do that for a stats panel though?   ... View more

@jacobpevans NICE!!! I tried something similar with subsearches and failed... but this seems like they way to go. Thank you! ... View more

Thanks a lot! ... View more

Thanks for the quick reply Jacob.  While that didnt work for our specific case I do appreciate the response.  In the end, and I am usure why TBH, this is whats currently in place and working for us to blacklist files that start with a dot (.) blacklist = \/dir\/dir\/syslog\/\.\S+ ... View more

Greetings Mrig342,   Here's a run-anywhere search that should get you what you want. You'll just have to update it to fit your data. It's important that you end the search with a stats command. | makeresults | eval File_System = "\logs", Disk_Usage = "41" | append [ | makeresults | eval File_System = "\opt" , Disk_Usage = "73" ] | append [ | makeresults | eval File_System = "\var" , Disk_Usage = "69" ] | append [ | makeresults | eval File_System = "\apps", Disk_Usage = "48" ] | stats max(Disk_Usage) by File_System ... View more