Hey @vrmandadi, To convert epoc time to human readable format you will have to create props.conf before indexing your data. Please update these setting in your props.conf for respected app: [Your_Sourcetype] DATETIME_CONFIG = INDEXED_EXTRACTIONS = json KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true TIME_FORMAT = %s%3N TIME_PREFIX = \/Date category = Structured disabled = false pulldown_type = true Let me know if this works. ... View more

Hi Chli, Thank you for your answer. If Addons built by Add-on Builder cannot support Splunk Cluster, then I was wondering how Splunk Add-on for ServiceNow works on Splunk Cluster? ... View more

Hi kishan2356, Is your search dependent on the tokens that you are applying? ... View more

Hi nkumar6, You can try the search below for last 7 days to compare 7 days data. Splunk Query: index=abc source=item_count |dedup item | timechart span=1d count by item ... View more

Hi manderson_rr, Your schedule in inputs.conf should be in a cron format. Like if you want the script to run for every 5 minutes your schedule should be equal to the examples in the link below: https://www.thegeekstuff.com/2011/07/cron-every-5-minutes/ Also you can add index in your inputs.conf if you want a separate index for the processes you are monitoring. And if you are adding a custom index don't forget to create this custom index on search head as well. ... View more

Hi balash1979, You can also directly extract fields from your search via Splunk UI using "Extract Fields". You can also check if your extractions are matching every field in the events. You can refer the Splunk doc for the same: https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/FXSelectSamplestep ... View more

Hi kimle, While uploading .csv file as a lookup in Splunk, it should be in a proper csv format. You should have your field in source_address and dest_address one after the other and not in a single sentence. The CSV file cannot contain non-utf-8 characters. Plain ascii text is supported, as is any character set that is also valid utf-8. And then you can try uploading your csv as a lookup and check the result. Let me know if you have any questions. ... View more

Hi, Don't run your search completely but try running it part by part so that you can find which part of your search is going wrong. ... View more

HI, The master is essential to the proper running of an indexer cluster, with its role as coordinator for much of the cluster activity. However, if the master goes down, the peers and search head have default behaviors that allow them to function fairly normally, at least for a while. Nevertheless, you should treat a downed master as a serious failure. To deal with the possibility of a downed master, you can configure a stand-by master that can take over if needed. You can go through the link below of Splunk docs for how to do this: https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Whathappenswhenamasternodegoesdown ... View more

Hi, Kindly check the link below on Splunk answers. It might help you. https://answers.splunk.com/answers/198494/colouring-header-of-the-table-in-splunk.html ... View more

Hi, When you run the 2nd search do you get any output or only annotation disappears? ... View more

Hi, You can check the accepted answers in the link below. It might help you https://answers.splunk.com/answers/374936/why-am-i-unable-to-viewdelete-a-users-dashboardsre.html ... View more

Hi, Try sending your backup file to temp folder of your destination and then move it to respected path. ... View more

Hi Fridays, How are you searching your fields? If you want to see all selected fields you need to search it in verbose mode and also make sure the coverage selected is "All Fields" ... View more

Hi, I hope you have followed the steps in below splunk documentation https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/Self-signcertificatesforSplunkWeb Also you can check below links on splunk answers if it helps you. https://answers.splunk.com/answers/490127/when-trying-to-create-a-self-sign-certificate-why.html https://answers.splunk.com/answers/225486/generate-self-signed-certificate-windows-is-there-1.html ... View more

Hi, Yes, this is a bug This and fixed in 6.6.4 and 7.0.1: http://docs.splunk.com/Documentation/Splunk/6.6.4/ReleaseNotes/6.6.4#Admin_and_CLI_issues ... View more

Hi, If you want multiple tokens to be selected then in dropdown you will have to select "multiselect" and accordingly you will have to modify your search PFB link on splunk answers, it might help you with this. https://answers.splunk.com/answers/592982/using-input-from-a-multi-select-input-field-for-po.html ... View more

Hi, If you want to reindex your data then your will have to add crcSalt in your inputs.conf. By default, the input only performs CRC checks against the first 256 bytes of a file. This behavior prevents the input from indexing the same file twice, even though you might have renamed it, as with rolling log files, for example. Because the CRC is based on only the first few lines of the file, it is possible for legitimately different files to have matching CRCs, particularly if they have identical headers. If set, string is added to the CRC. If set to the literal string "SOURCE" (including the angle brackets), the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC. When crcSalt is invoked, it is usually set to SOURCE. Be cautious about using this setting with rolling log files; it could lead to the log file being re-indexed after it has rolled. In many situations, initCrcLength can be used to achieve the same goals. Default: empty string. ... View more

Hi, Please find the accepted answers in below link on splunk answers, this might help you: https://answers.splunk.com/answers/202023/is-it-possible-to-create-a-macro-to-do-this.html ... View more

Hi, I dont think it is possible to restrict the user from creating their own private search however, you can restrict ability to write to the search app by disabling write permissions in the app. UI > manage apps > search & reporting > permissions> remove write capabilities for roles as desired. ... View more

Hi, You can try putting your token in " ". So your search should look like ...| search AppNo="$app$" ... View more

Hi, Can you give some sample of your time format. So if you also have seconds and milliseconds in your events, then you will have to change your TIME_FORMAT in props.conf as below: TIME_FORMAT=%H:%M:%S.%N ... View more