@mbachhav - did you get this done ? I am running into similar challenge and thinking best way of getting this from HF to SHC/Indexer  ... View more

Try this -    "Account\sName:\s(?P<account_name>.+)\sAccount Domain" ... View more

index=star env=prod | chart count(eval(time <100)) AS "<100ms", count(eval(time >100 AND time <200)) AS "<200ms", count(eval(time >200 AND time <300)) AS "<300ms" | stats count by time   try that query and select pie chart under visualizations. ... View more

@Sharzi try this to return records where DB is NOT "unknown"     base_search [ inputlookup myLookup | fields TenantName, tenantId | where tenantId!="Unknown" AND TenantName=TenantName] | lookup myLookup tenantId TenantName output TenantName, tenantId, Region, DB | | table _time TenantName tenantId Region Status DB       updated reply to correct spellings and missing fields ... View more

@gitingua  can you share your search query that you're trying for this result ? ... View more

you could probably do the lookups at the end of the tstats search & all transforms   | tstats ... | search [| inputlookup field1 lookup1.csv | ... ] | search [| inputlookup lookup2.csv | ... ]   ... View more

@Susha  Is your forwarder sending disk space data and are you able to see any data in index=os ? breakdown the search query into individual parts and check  index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com | strcat host '@' Filesystem Host_FileSystem     ... View more

@pavanae  can you share your search query ? But you should be able to search the host like following -  | inputlookup answers-571895.csv | where Host="*"   ... View more

It should work, I tried it out with csv file you shared.  It can either be permissions (but you're able to see contents of lookup using inputlookup).  Check the fieldnames (case-sensitive) & also spell-check Try another way (replace with your filename) -  | inputlookup answers-571716.csv | where failcode="g-ab" OR failcode="c-cd" OR failcode="d-dd"   ... View more

are you able to see the contents of the lookup file created ? run the following command | inputlookup myfile.csv   ... View more

Hi @gitingua    try this out, assuming you've these files uploaded as lookups     | inputlookup file1.csv | appendcols [inputlookup file2.csv | fields ASN,Other ] | table username,src_ip,ASN,Other   ... View more

@MikeB  inputlookup can be used to fetch results.  | inputlookup myfile.csv | where failcode IN ("g-ab", "c-cd", "d-dd") ... View more

@GRC  Sample log events data will help to work further on your request. ... View more

@LIP  can you share sample events and the search you're trying to run ? ... View more

Thanks @isoutamo  But how do I search logs related the frozen buckets or purged data? ... View more

hi @MuS, This is great. can this app be used on Search Head cluster without causing any issues ? Thanks ... View more

hi @lyndac I am in exact similar situation ? were you able to identify and make it working successfully with batch input. Just want to make sure, the file is completely indexed before deletion and newer files keep getting created in the directory with application requests, so they need to be monitored, forwarded and deleted. Thanks ... View more

Thanks. does Splunk Stream pull DNS analytics log data ? if so, how can it be done ? do we need to install the Splunk stream on all the DNS servers? ... View more

Hi @gjanders I deployed the app "Windows DNS Analytical and Diagnostic Logs" on the DNS server , where the DNS Analytical logs are enabled and also see the log file grow with events, but however the logs are not being forwarded by the Universal Forwarder running on the DNS server. Anything different, that's required for the setup ? Thanks ... View more

@gawilliams Were you able to send these ETL logs using universal Forwarder and Add-on ? ... View more

hi @jawaharas Yes, we're using index clustering. I tried to delete the distsearch.conf again today and restarted splunk on the search heads and found it was re-created on all except one search head in the cluster. [sslConfig] sslKeysfilePassword = $1$EDkhKG6tJRyF sslPassword = $1$EDkhKG6tJRyF [lmpool:auto_generated_pool_download-trial] description = auto_generated_pool_download-trial quota = MAX slaves = * stack_id = download-trial [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder quota = MAX slaves = * stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free quota = MAX slaves = * stack_id = free [general] pass4SymmKey = $1$EXktLS6/MxP38oI= serverName = eo1vmsk099.lema [license] master_uri = https://eo1vmsk444.lema:8089 [replication_port://8090] [raft_statemachine] disabled = false [shclustering] conf_deploy_fetch_url = https://eo1vmsk555.lema:8089 disabled = 0 mgmt_uri = https://10.XXX.XX.XXX:8089 id = 013107EC-FC15-4338-A045-75942E648CB7 [clustering] master_uri = clustermaster:eo1vmsk555.lema:8089 mode = searchhead [clustermaster:eo1vmsk555.lema:8089] master_uri = https://eo1vmsk555.lema:8089 multisite = 0 site = default pass4SymmKey = $1$EXktLS6/MxP38oI= ... View more

hi @burwell We don't have any automation or CM tools monitoring file systems that would restore the file. And the file is created by user that runs splunk on the server. We tried to delete the file and restart splunk, but it gets restored again. ... View more