We are currently required to upgrade our Splunk environment from version 8.2.4 to version 9.x, and we are concerned about any differences in Splunk SPL function functionality, as we encountered "streamstats" during our previous upgrade to version 8.2.4. below are the components of our environment: 1- Three heavy forwarders 2- Clustering of indexers: One master machine and three indexers 3- Search Clustering: One SHC and three Search members 4- Standalone search machine 5- Two Splunk DB Connect machines  6- Deployer used to manage external universal forwarders installed on external nodes to collect real-time data. So, if anyone encounters any major issues following the upgrade, please share them with me so that they can be taken into account, and this will be greatly appreciated. ... View more

Hi everybody, I need your assistance if you have encountered this problem or not since I want to mask a particular field before it is processed by SPLUNK indexers. I need to mask a particular field because the data will be transferred via a universal forwarder (an externally installed agent). Regards, Amira   ... View more

We are seeing strange behavior after updating Splunk from 8.0.4.1 to 8.2.4. The major issue is with all queries that use the streamstats command; after observing this behavior, we updated the command to include the time difference as well, dividing over the time delta when computing the difference between the two events. Occasionally, graphs display regular statistics for a short period of time before switching to an abnormal view (due to dashboard auto refresh). If anyone encounters such a problem, please let me know since most of our dashboards are affected, and we attempted to generalize and adapt this to all of these dashboards in the hope that this will cure the problem.   ... View more

Dears What are the main differences between calculating SPLUNK daily license from the ready-made query located in SPLUNK master (DMC Alert - Total License Usage Near Daily Quota) And from using below query: index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by idx | eval LicenseUsage_GB = round(bytes/1024/1024/1024,5) |table idx LicenseUsage_GB As I found a remarkable differences when using the 2 above ways even when calculating the total available license. Thanks ... View more

Dears, i have a question please, is there a way to get the number of records which output from splunk through SPLUNK DB Connect through oracle driver. Also, is there a way to insert only to the database without making insert & Update with each output? ... View more

please need your support as SPLUNK didn't parse all files from same path, i.e for example in my inputs.conf there are 2 stanza to monitor two paths. each path has around 1250 files, so i should find around 2500 files when searching for files. i updated inputs.conf with (crcSalt = ** and **initCrcLength = 2000) and nothing occurred i found only the exact number of files after restarting SPLUNK service, so is it a mandatory to restart splunk every time i got the files to be parsed ?!!! [monitor:///home/Path1/.xml] disabled = 0 host_segment = 4 index = index1 sourcetype = sourcetype1 recursive = true **crcSalt = initCrcLength = 2000* ... View more

please need your support as SPLUNK didn't parse all files from same path, i.e for example in my inputs.conf there are 2 stanza to monitor two paths. each path has around 1250 files, so i should find around 2500 files when searching for files. i updated inputs.conf with (crcSalt = and initCrcLength = 2000) and nothing occurred i found only the exact number of files after restarting SPLUNK service, so is it a mandatory to restart splunk every time i got the files to be parsed ?!!! [monitor:///home/Path1/*.xml] disabled = 0 host_segment = 4 index = index1 sourcetype = sourcetype1 recursive = true crcSalt = initCrcLength = 2000 ... View more

Dears I have an urgent Question regarding SPLUNK DB Connect module we have SPLUNK DB connect module installed on a standalone Virtual machine, we restarted SPLUNK service on this VM. After restarting the service we found that some inputs stopped getting data automatically and stopped showing data on SPLUNK search-head machine however when running the query from SQL Editor we found data. There are more than one input assigned to 1 connection, some of them are working normally and the others are stopped as mentioned above we applied below mentioned work around separately: 1. We tried to run the query once manually in SPLUNK search using dbxquery and returns data, after that the inputs started to get data again every 5 minutes as it was saved and working automatically. 2. We created new connection (copy from the existing one) to this input and the input worked again automatically. 3. We changed the execution frequency from crontab to number of seconds. (instead of: */5 * * * * to: 300) and vice versa after it stopped again each solution work temporary for a while and the inputs stopped again. ... View more

Dear SPLUNK users, i have a question regarding SPLUNK DB Connect, as i want to access database (MySQL) where the table name is varied daily according to the timestamp. So there a way to access these table through SPLUNK DB connect? please advise ... View more

Dears, please i need your support as i am creating new dashboard, the number of panel included in this dashboard is depending on the output of search query ( for each unique source there will be single panel) this dashboard will be refreshed every 5 minutes to view new data so i need to create a loop to access all sources individually, for each panel i will create new query to show statistics for example: 1- Main Search: index=x sourcetype="oracle:db" "search for specific string" | dedup source|table source output:the output is variable source1 source2 source3 2- for each source, i need to create panel with some regex index=xsourcetype="oracle:db" source="source1" earliest=-5m latest=now|rex field=source "(?([-\w]+?))(?(\w+?))(?(\w+))" |timechart span=15m last(NODE) as Node , last(INSTANT) as Instance,last(QUEUE) AS Queue avg(QUEUE_COUNT) as QueueCount so is there a way to create such dashboard ? ... View more

i am searching for a way to accelerate dashboard the dashboard contains 4 panels, each of them is running same search but with different time picker i mean: Panel 1: for 1 hour Panel 2: for 24 hours panel 3: for 1 week panel 4: for 1 month the 3 panels are taking too much time till viewing the results (line chart) so i need such an easy way to enhance the dashboard performance ... View more

Dears, I am getting data from database using Splunk DB Connect, the data is stored in Arabic and needs to be encoded in Splunk. I have edited props.conf with the character set configuration as below, but the data still appear I tried all below configurations 1: [sourcetype] CHARSET= CP1256 2: [sourcetype] CHARSET= ISO-8859-6 3: [sourcetype] CHARSET= AUTO ... View more

Hello all, I need to know all differences between append, appendcols, and join when being used with pipe while searching in xml file. Also, I need to know the effect of every command in the performance and if any of them causes interference between events. Regards, ... View more

Hi all, i am using SPLUNK DB connect to save data into oracle database. the problem i found is the data is getting duplicated randomly in the database. i mean for eample when searching for data in SPLUNK i got just 1 record but after inserting these result to oracle database by DB output i find that the selected record was duplicated So is there a solution to avoid such this case as instead of saving 85,000 records, 400,000 records are saved Regards, ... View more

I want any method or a way to convert a text file into XML file using SPLUNK ... View more