Hello @rameshkommu , I don't think there's a possibility to add a placeholder text for any of the input. The value that you define in the DefaultValue actually gets passed as the value in the panels wherever the input is being referenced. You may want to raise an idea on ideas.splunk.com to have the feature included as part of new release.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Additionally, you can also try rolling the bucket manually as mentioned in the reason. The SF isn't met because it needs the bucket to be rolled. Click on the Actions drop down and roll the bucket. This should also help you fix the SF/RF not met issue without any downtime.   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated. ... View more

Hello @karthi2809, I'm not sure if searchmatch function can work with case condition or not. I've read that it must be used inside if condition. Can you try running the following search: | rename bucketFolder as BucketFolder | eval InterfaceName=case(BucketFolder like "%inbound%epm%","EPM", BucketFolder like "%inbound%KPIs%","APEX_File_Upload", BucketFolder like "%inbound%concur%","ConcurFile_Upload",true(),"Unknown") | stats values(InterfaceName) as InterfaceName min(timestamp) as Timestamp values(BucketFolder) as BucketFolder values(Status) as Status by correlationId | table Status InterfaceName Timestamp FileName Bucket BucketFolder correlationId   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated. ... View more

Hello @SReopelle, Additionally, you can try checking the list of KOs in All Configurations page from the Settings menu. You'll be able to find all the knowledge objects there.   Thanks, Tejas. ... View more

Hey @Tetonka , If you would have appeared for the Architect examination from Pearson VUE, then on the pearson portal itself you should be able to validate your results. Also, once the certification is cleared, it stays valid till either 2 or 3 years. I do not exactly remember it. And you can renew them by reappearing for the examination. Alternatively, you can also reach out to certifications@splunk.com for any queries.   Thanks, Tejas.   ... View more

Hello @jwhughes58 , Using REPORT, you generally call the transforms stanza that has the transformations written for extractions, routing, etc. You can simply write the regex that matches against _raw and extract the field required. If you use REPORT and call the transforms to extract the field, the same thing will happen.  If you necessarily want to use EXTRACT, you need to extract the Match_Details.match.properties.user field at index time and replace the (.) with (_). Then you'll be able to use EXTRACT parameter in props.conf for search time field extractions. Additionally, you can also consider using rex command in the SPL query to extract the fields at search time.  Relevant documents: https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Rex Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @SewingMachine77, I do not think there is a possibility to create templates and use them in the alerts. However, you can definitely customize the message for the saved search. Additionally, you can also use the search job tokens and use them in the message. Refer to the following document for assistance with search job tokens: https://docs.splunk.com/Documentation/Splunk/9.2.1/Alert/EmailNotificationTokens   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated.  ... View more

Hey @SplunkExplorer , As you mentioned, it indeed is a permission issue. The lookup might be created within the search app context and the permission might not be shared to access the lookup within different app context. You can update the permission of the KO to be shared globally and it should resolve your concern.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @dhana22 , For using cluster manager redundancy, I would suggest you to use the load balancer to switch between the active and the standby cluster managers. As per the following document as well, if the manager switch over mode is set to auto, ideally load balancing using a 3rd party load balancer would be the best possible solution to configure the indexer peers and the search heads. Document link - https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/CMredundancy#Configure_peer_nodes.2C_search_heads.2C_and_forwarders   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @heres , As per the latest version release notes, Mission Control is part of the exception list. It means that the Upgrade Readiness App will not be scanning the Mission Control app. Please find the following screenshot for your reference. Document link for exceptions - https://docs.splunk.com/Documentation/Splunk/9.2.1/UpgradeReadiness/About#Exceptions The doc link doesn't yet mention of adding Mission Control to the exception list. However, you can find the same on Splunkbase release notes: https://splunkbase.splunk.com/app/5483 Navigate to Version History and launch the release notes for v4.3.0   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated. ... View more

Hello @kgiri253 , While using geostats, you might want to increase the globallimit parameter value which would not club the other countries into OTHER field. You can set it's value to any integer as per the requirement. And if you wish to display all the results, you can set the value to 0.  Here's the documentation link for the same - https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Geostats   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @SampathkumarK , When you whitelist or blacklist a particular host for a serverclass from the web UI, it creates the configuration in serverclass.conf config file with the respective parameters. You can match the regex for whitelist/blacklist with the required pattern and validate if the host is matching the pattern or not. Also, phoneHome happens with every phoneHome interval that has been defined. You can find the detailed explanation in the following document - https://docs.splunk.com/Documentation/Splunk/9.2.1/Updating/Useserverclass.conf   Thanks, Tejas. ... View more

Hello @shabamichae , You should check for _internal index and source=*python.log. This would help understand better why the PDF creation failed and what actually is the reason for dashboard not being part of the email attachements. I suspect that since the dashboard is complex and have multiple graphs, there should be connectionTimeout error which you can tweak in the configuration files. However, concrete reason and solution can be devised on the basis of the ERROR message only. Thanks, Tejas. ... View more

Hello @auzark , You can assign a particular field to _indextime and then use that to find the difference. The only catch here would be that _indextime would be in epoch time and hence, you'll have to convert the GenerationTime into epoch format before calculating the difference. Your query should look something like below: index=splunk_index sourcetype=splunk_sourcetype | eval tnow = now() | eval indexTime = _indextime | eval GenerationTime_epoch=strptime(GenerationTime,"%Y-%m-%d %H"%M:%S") | convert ctime(tnow) | convert ctime(_indextime) as Index_Time | eval secondsDifference=indexTime-_time | eval GenTimeDifferenceInSeconds = GenerationTime_epoch-indexTime | table Node EventNumber GenerationTime Index_Time, _time, secondsDifference,GenTimeDifferenceInSeconds   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated!! ... View more

Hello @kate , Below are two things that you can check: 1) index=_internal host=<<ubuntu_hf>>  ---> Check if there are any events or not. Even if there are few events, it means that connectivity is established. 2) Did you restart splunk after installation of Splunk Cloud UF credentials package? If the above two approaches do not help, check for splunkd.log on the ubuntu UF instance itself. It should point out to why it is failing to send the logs to SplunkCloud. Thanks, Tejas. --- If the above solution is helpful, an upvote is appreciated. ... View more

Hello @Isaac_Hailperin , Can you share what steps have you taken so far? That would help understand what is actually missing. Thanks, Tejas. ... View more

Hello @NickNguyen , On the Enterprise instance itself, you can find the Monitoring Console that ships OOTB with the Splunk Enterprise package. You can navigate to Settings > Monitoring Console > Resource Usage > CPU Usage: Instance dashboard and that'll help you identify the CPU usage of the instance. From the panel also, you can open the search by clicking the magnifying lens icon when you hover through the panel and set an alert as per the required threshold.    Thanks, Tejas. --- If the above solution helps, an upvote is appreciated. ... View more

Hey @ShamGowda , What is the concern here? Have you got the data already in the respective index? Also, have you explored Splunkbase already? There are quite lots of apps that helps visualizing the memory and CPU usage.   Thanks, Tejas. ... View more

Thank you for the insights @hrawat_splunk . I believe this should be part of Monitoring Console as well to identify the queue behavior.   Thanks, Tejas. ... View more

Hey @MrJohn230, In the classic dashboard framework, changing the background color of the chart is something that is not possible.  In the dashboard studio, you can update the options parameter to change the background color. Reference for Dashboard studio - single value visualization - https://docs.splunk.com/Documentation/Splunk/9.1.2/DashStudio/chartsSV#Single_value_2   For having a background color in classic dashboard, you would need to use charts and not the single value visualization - https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/Viz/ChartConfigurationReference   --- If the above answer helps you, an upvote is appreciated. ... View more

Hey @SplunkExplorer, It seems that a few hosts are sending in classical text format and not in XML format. And yes, you can run the btool command to identify the parameter setting. Below is the btool command for your reference: $SPLUNK_HOME/bin/splunk btool inputs list WinEventLog://Security --debug | grep renderXml   ... View more