On our Monitoring Console on the "Overview", it does not display any metrics under "Resource Usage" for each of the categories "Indexers", "Search Heads", etc.  Not the browser, have tried from different computers, same problem.  No WARN or ERROR messages on the host, no errors in the "Setup" page, and CPU/RAM utilization is extremely low. Anybody else experienced this? ... View more

Upgraded several independent instances of Splunk Enterprise from various starting points, all to 9.1.0.1.   Some clustered, some standalone. 8.1 -> 9.1.0.1 9.0.1 -> 9.1.0.1 All had the same outcome:  When browsing to: Settings > Users and Authentication > Users, most but not all users are no longer visible in the 'Users' list, but the users still have access as validate by Splunk logs.  In the most severe case there were 100+ users, mostly SAML, some local.  Post upgrade there are 4 showing, yet in validation all can still login ... View more

I have a query that must search 9 weeks of data, and then applies a filter against a single field (dv_opened_at) looking for specific events that occurred within an 8 week period.  Initial 9 week search is necessary to catch events that were modified after the end of the last week, yet had a dv_modified_at time within the last 8 weeks.  query     index=cmdb (dv_number=* OR number=*) dv_state=* dv_assigned_to[| inputlookup cmdb_users.csv| table dv_assigned_to ] earliest=-8w@w latest=now() | table _time number dv_number dv_opened_at dv_assigned_to dv_short_description dv_watch_list dv_sys_updated_on dv_state close_notes | dedup number | eval dv_opened_at=strptime(dv_opened_at,"%Y-%m-%d %H:%M:%S") | where dv_opened_at>=relative_time(now(), "-8w@w") AND dv_opened_at<=relative_time(now(), "@w") | eval _time=dv_opened_at | bin _time span=1w | eval weeknumber=strftime(_time,"%U") | rename dv_assigned_to AS Analyst | timechart limit=0 useother=false span=1w count BY Analyst     The problem is, the timechart outputs 9 weeks of data, and as expected the last week is all 0's.  How do I eliminate the current week from the output, but keep the current week in the initial query? Output     _time Analyst1 Analyst2 Analyst3 Analyst4 2022-05-08 19 6 0 0 2022-05-15 5 4 0 0 2022-05-22 8 2 0 1 2022-05-29 7 4 0 0 2022-06-05 1 3 1 39 2022-06-12 7 1 4 51 2022-06-19 3 2 0 59 2022-06-26 25 5 2 26 2022-07-03 0 0 0 0 #how to drop this row each weekly report     ... View more

I am working producing a table that calculates the number of incidents resolved by each analyst.  What my query does is produces a table with three columns with a count of 'Class Names': Analyst / Class Name / count What I am trying to do is produce an output with (4) columns with a count under the descrete columns and a total of the row to the right: Analyst / Class Name 1 / Class Name 2 / Total Count (of all class names)     <query> | table "Analyst" "Class Name" | stats count by Analyst "Class Name"       ... View more