Hello @splunky_diamond, As stated by 2 folks, resource consumption depends on multiple factors. If you are planning to enable ~15 use cases in ES for learning purpose with all-in-one test environment, 32 GB RAM, 32 vCPU, and 200 GB hard disk should be enough. Base configuration for ES is as below -  https://docs.splunk.com/Documentation/ES/7.3.1/Install/DeploymentPlanning ... View more

Better to raise Splunk Support case for better troubleshooting 🙂 ... View more

Hello @dc18, have you checked https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatch and searched for EC2 on the page? ... View more

+1 with @TheLawsOfChaos, It's a common practise to create a Role with "Read Only" permission. You have any further questions / issues with respect to this @treven? ... View more

Hello @493600, There is no OOTB of achieving this. Usually, we have to download the events in _raw format, upload it on a test environment which has latest version of TA along with CIM Validator installed - and validate the field extraction. Commands like fieldsummary can help in comparing the field name and values - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldsummary   Please accept the solution and hit Karma, if this helps! ... View more

Hello @matoulas Can you please elaborate the question? One liner isn't seems to define the actual problem 🙂 ... View more

Let me agree with your disagreement 🙂 Do you agree with the answer though is the question - The 4 points mentioned initially to centrally get the events on a single server and monitor the same? ... View more

Hello @PickleRick the other 4 points you mentioned was of no use, which is why it's not included in the answer. Couple of points -  1. The question author have mentioned - " I'm fairly new to Splunk and I'm still learning how to set things up so as many details as possible would be helpful." - Which is why the answer mentions about having everything at one place and monitor it later - which is usual practice. 2. Community answer initiate a "thread" where further discussion can be in place about what and how to achieve the solution 3. The question also mentions "I believe the process is to have the printers redirect their logs to the print server to a specific folder, then add that folder to the list of logs being reported in the Splunk forwarder. Does that sound correct?" - which is the one of the best way to monitor the logs from one place. 4. It's not copy-pasting answer, it's about taking a reference -> looking over authenticity -> Updating it as required and sharing with community. One could literary ask each and every Splunk Community question over GPT and paste the answers - but that's not being happened. We as a community wants to use new tools along with making sure whatever we are posting is authentic and actually helps the ones who posts here 🙂 ... View more

Hello, Just checking through if the issue was resolved or you have any further questions?  ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @splunkreal, Just checking through if the issue was resolved or you have any further questions? If not, can you please accept the answer, so anyone in the future having the same question can get the solution quickly? ... View more

Hello @maverick27 sort should work in that case right? ie. -  | sort GroupNum S_no ... View more

Hello @SplunkDash, Can you please check below -  | makeresults | eval _raw="accid,nameA,addressA,cellA 002,test1,tadd1,1234 003,test2,tadd2,1256 003,test2,tadd2,5674 004,test3,tadd3,2345 005,test4,tadd4,4567 006,test5,tadd5,7800 006,test5,tadd5,9900" | multikv forceheader=1 | eval sourcetype="sourcetypeA" | append [| makeresults | eval _raw="accid,nameB,addressB,cellB 002,test1,tadd1,1234 003,test2,tadd2,5674 004,test3,tadd3,2345 005,test4,tadd3,4567 006,test5,tadd5,9900" | multikv forceheader=1 | eval sourcetype="sourcetypeB" ] | kv | stats values(*) as * by accid | where mvcount(nameA) != mvcount(nameB) OR mvcount(addressA) != mvcount(addressB) OR mvcount(cellA) != mvcount(cellB)   Please let me know if you have any questions for the above. Please accept the solution and hit Karma, if this helps! ... View more

Hello @VashisthaPandya, Do you really want to have a "real-real" traffic or dummy would work? Because you can generate dummy Windows EventCode traffic through EventGen (https://splunkbase.splunk.com/app/1924) and deploy it and focus on writing effective search query. ... View more

Hello @ezmo1982 , Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @short_cat, I don't think it's possible. I tried with makemv as well, something like -  | makeresults | eval message = "This is line 1.\nThis is line 2.\nThis is line 3." | makemv message delim="\n" But it's not sending the message as expected and just considering first line as below screenshot -  I would suggest checking with the project contributors over GitHub - https://github.com/splunk/slack-alerts 🙂 ... View more

Hello @viktoriiants, How about sorting it by 'Session count' before date desc? ... View more

Yes, what you're describing is possible and it's a common approach to collect logs from devices that can't directly forward logs to Splunk. Here's a high-level overview of the steps involved: Configure Printers to Send Logs to Print Server: You'll need to configure your printers to send their logs to a specific location on the print server. This might involve setting up syslog or other logging configurations on the printers themselves to point to the print server's IP address and designate a specific directory for log files. Set Up a Log Forwarder on Print Server: On the print server, you'll need to set up a log forwarder to monitor the directory where the printers are sending their logs. This can be done using Splunk Universal Forwarder or any other log forwarding mechanism suitable for your environment (like syslog-ng). Configure Splunk Forwarder to Monitor Log Directory: Once the print server is receiving logs from the printers, you'll need to configure the Splunk forwarder on the print server to monitor the directory where the logs are being received. This involves adding a new monitor stanza in the inputs.conf file of the Splunk forwarder. Verify and Test Configuration: After configuring everything, you'll need to verify that logs are being received by the print server from the printers and that the Splunk forwarder on the print server is successfully forwarding those logs to your Splunk indexer or another forwarder. In a nutshell, the idea to have everything available at one place and monitor instead of onboarding / installing TA individually on each host.   Please accept the solution and hit Karma, if this helps! ... View more

Hello @aydinmo This could be because of Data Model Acceleration Enforcement. What it does is, even if you turn DMA On/Off - it will enforce the default behaviour. Can you please check the configurations from Settings -> Data Model Acceleration Enforcement Settings and Enable / Disable the default behaviour as required. Below screenshot for your reference -      Here is the Splunk Doc for your reference - https://docs.splunk.com/Documentation/ES/7.3.0/Install/Datamodels#Data_model_acceleration_enforcement   Please accept the solution and hit Karma, if this helps! ... View more

Can you please try appending below -  | makemv delim="," allowempty=t CmdArgAV   Please accept the solution and hit Karma, if this helps! ... View more

Seems fairly simple / basic configurations. I would suggest raising Support case to get this troubleshot and fixed. @isoutamo thoughts? ... View more