apologies for the delay.... Yes, all operating as expected post workaround ... View more

FOUND A FIX!... or workaround rather and hopefully it works for you all. i've been working tirelessly with a splunk senior technical support til midnight for the past 2 days in an effort to fault find and fix this problem. Support seem to think it is a scaling issue as they suspect network latency and our 2 indexers being overwhelmed.  This makes no sense to me as our environment is sufficiently scaled based on splunk validated architecture number of users and data ingestion amount.  Anyways, i've spotted the issue classed as uncategorised under 9.0 known issues. Was only logged 2 weeks ago and i'm surprised (or not really) that support failed to pick this up rather take me on a wild goose chase of fault finding turn off the useACK setting useACK = false on any outputs.conf file you can locate on the affected instances then restart for changes to take effect. This should stop the tracker.log errors and data should continuously flow through again       ... View more

same problem here, only appeared immediately after 9.0 upgrade ... View more

@bowesmana thanks for your input. I've tried other suggestions i.e placing quotation marks, removing <> but no die. it seems you are right by documentation that it is not possible due to tags created last during search time operation order. i will instead use linebreaking to break the events correctly, this way the fields i care about will be created automatically at index time. ... View more

the BIMEJob field returns multiple values but i want only 2 values as defined in the tag.   Apologies i do not understand why it would not return results for the tag as the BIMEJob field does contain the values in the tag, just doesnt show it in the search ... View more

Just needed a server restart for the changes to take full effect... d'oh!   Status is now CONNECTED 🙂 ... View more

following your advice i've managed to get on to a new proxy server that supports websockets. No need for SSL exemption. At this point, the dashboard is looking alot healthier however the cloud gateway status is still displaying NOT CONNECTED Examining the gw app internal logs there arent any errors but several debug messages stating: 2021-01-11 15:38:19,717 DEBUG [drone_mode_modular_input.app] [drone_mode_subscription_modular_input] [do_run] [105715] Drone mode modular input will not run as drone mode is not enabled   The mobile application dashboard still shows 'Oops, something went wrong'   any ideas?  Thanks In advance ... View more

thanks for the quick response!   yes, our proxy does SSL inspection if i request a bypass, what exactly am i requesting to be bypassed? also, any instructions on how to configure splunk to trust our proxy ca cert?   Thanks in advance    ... View more

thanks for the quick response!   yes, our proxy does SSL inspection if i request a bypass, what exactly am i requesting to be bypassed? also, any instructions on how to configure splunk to trust our proxy ca cert?   Thanks in advance 🙂 ... View more

I've got it to work with the below ... | rex "ESS1\s\s\s\s\s\s\s\s\s\s\s\s\s\s.\s\s\s[(?[^]]+)" ... View more

I've got it to work with the below ... |rex "ESS1\s\s\s\s\s\s\s\s\s\s\s\s\s\s.\s\s\s[(?[^]]+)" ... View more

Thanks MuS I think this would work though I've just realised when raw data I pasted in didn't include the whites spaces... ESCO - [57] ESDC - [82] ESEM - [170] ESS1{14whitespaces}-{3whitespaces} [2813] ESVI - [706] F421 - [30] ... View more

Hi All, I'm trying to achieve the something similar using regular expressions on raw data... I want to extract the figures at the end of row ESS1. if some-one could help me extract the field and strip out the figures would be great! ESCO - [57] ESDC - [82] ESEM - [170] ESS1 - [2813] ESVI - [706] F421 - [30] Thanks Bablucho ... View more

How is a different format for _time going to resolve your 'doubling' of timechart results? because the LoginTime is showing a result in Timechart as 01/08 but the _time value is also in the Timechart showing as 08/01. I want to remove the _time value. Are you trying to use the Date field (login time) to be your time over which you want to build the timechart? Yes. Yes, you are right i meant eval _time=time BUT then i want to see how you are building the field 'time', in other words the eval preceding eval _time=time , ie eval time=??what. should be equal to Login time field Can you share your query? base search| timechart dc(Username) span=1d ... View more

Hi Vijeta, I'm running the following SPL base search| timechart dc(Username) span=1d the data is being pulled from a file that uses a specific column (LoginTime)as the time field. the timechart is showing 1 event with 01/08/2018 23:15:29(LoginTime) 1st of August the timechart is also showing a result for 2018-01-08T23:15:29.000+00:00(_time) 1st of January it should only show the LoginTime field as the time values not the _time. ... View more

did you mean base search |eval _time=time|timechart dc(Username) I'm getting a limited number of events and no timechart visualisation ... View more

actually its not in a field 3... the below is an extract from an event. when I try to manually extract it does not show the full event past line 18 so I thought maybe a regex will be able to pull the data 'Printed: <001527> Selected: : 001558 Deceased : 000003 GoneAway : 000007 Suspended : 000023 Sent2Print : 001527 ===== : === Printed : 001527 ===== : === ... View more