Hi all, I am trying to run a search that returns one row of results over a long historical time window on a per hour basis. Due to investigation method, I need to run this over around almost 60 days. The search cannot be timecharted or timeboxed via stats because there are subsearches that return fields relevant for that particular hour... I was thinking of the below search in a scheduled search... Each time range will have a row with results as well because we have append=true The problem is, if there are no results than the row is not generated, & as a result, the time lookup is stuck at that time, window & stale.. How do I account for this? OR Is there a better approach to run searches multiple times on a time basis. e.g 1 hour. index=_internal [| inputlookup results_and_time.csv | tail 1 | fields earliestTime latestTime | rename earliestTime as earliest , latestTime as latest | format] | addinfo | stats values(sourcetype) as sourcetype earliest(info_min_time) as earliestTime , latest(info_max_time) as latestTime | eval earliestTime = relative_time(earliestTime,"+1h") , latestTime = relative_time(latestTime,"+1h") | outputlookup append=true results_and_time.csv p.s. Adding the time range manually for the initial run without the inputlookup to add the earliest & latest.. ... View more

Hiya Bucketheads after running rebuild on a index, quite a lot of buckets were not fixed with below reason. failed: Error reading rawdata at offset=xxxxxx : rawdata was truncated What is the cause of this problem . Can those buckets be fixed at all ? The rebuild process was not successful so I have doubts? we have previously tried the suggested disable/enable index method. Splunk 7.2.3 (build 06d57c595b80) Repair entire bucket, index=cylo, tryWarmThenCold=0, bucket=/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652, exists=1, localrc=3, failReason=(entire bucket) Rebuild for bkt='/opt/splunk/data/hotwarm/cylo/db/db_1546980225_1546977033_652' failed: Error reading rawdata at offset=17870904: rawdata was truncated ... View more

Hello Team Using the Workday add-on the logs in some cases do not have the level of detail we see in workday UI ( for audit). e.g. We may see that account has been changed/edited but not what privilege group is added to it etc A query was raised if we may have more detailed info using rest api.. However my gut feeling is that the Workday add on is already utilizing the same REST API endpoint(s) & the level of information seen through the addon will be the same as that with any bespoke work done using REST API work? ... View more

I am working with ES Splunk & want to increase the oplogSize from 1Gig to 2Gig.. From KVStore hammer .conf talk: 1GB even works fine for a while with premium apps — until it doesn't https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Serverconf the default Serverconf file does not seem to have oplogSize setting at all. So how is the 1Gig limit enforced? oplogSize = <integer> * The size of the replication operation log, in MB, for environments with search head clustering or search head pooling. In a standalone environment, 20% of this size is used. * After the KV Store has created the oplog for the first time, changing this setting does NOT affect the size of the oplog. A full backup and restart of the KV Store is required. * Do not change this setting without first consulting with Splunk Support. * Default: 1000MB (1GB) ... View more

Hi, I have noticed issue that loadjob sometimes gets stale & loads oldest version of job instead of loading latest. For small interval searches, it may not be a major issue. But is certainly very dubious when you have search spanning last 24 hours etc. Splunk Enterprise Version: 7.1.1 & Build: 8f0ead9ec3db with SHC Is this fixed in a newer version or has it been raised a a bug already? This was an issue in past with version 6.4.4 & seems to have cropped up again! Nothing here: https://docs.splunk.com/Documentation/Splunk/7.1.2/ReleaseNotes/KnownIssues ... View more