we are using the tabs extension: tabs.js, tabs.css (from https://github.com/LukeMurphey/splunk-dashboard-tabs-example) today we upgraded our splunk from 8 to 9 and after all tabs are not working , they are visible but nothing happen when we click the tab name. I have tried: 1. updating the code to the one in the git link above 2. also solution in https://community.splunk.com/t5/Dashboards-Visualizations/Tabs-in-Splunk-dashboard-not-working-after-Splunk-7-3-upgrade/m-p/482436#M31634 any help would be appreciated  ... View more

I have index that suddenly stoped indexing data. even after I entered crcSalt = <SOURCE> to the inputs.conf file data is not indexed anymore the logs continue to show the following error: "File will not be read, is too small to match seekptr checksum (file=<file_path>). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info." any idea how to resolve this issue? ... View more

I have connected my blob storage to splunk the files are uploading to the index but the csv format is not working, each line is a different result with no header extraction to every result I have tried Sourcetype: mscs:storage:blob:csv and csv but it didn't work when I try to upload the csv as a data input than splunk recognize the csv format and extract the headers correctly. what am I missing? are there more changes needed to extract the fields correctly? ... View more

I am getting the error below "File will not be read, seekptr checksum did not match (file=<file name>0). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info." I have crcSalt = <SOURCE> in the inputs.conf what more can I do? ... View more

Hi I have created a summary index from an existing index using tstats but, when I try to use tstats directly on the data in the summary index it doesn't work, I can only using stats is there a reason or a workaround? ... View more

I have a summary index that I created from existing index by using tstats command. when I try to use tstats on the summary index I get no results (stats will work) any idea why? ... View more

just created a new data input to be uploaded to a new index I don't see data inside the index how can I troubleshooting this issue? ... View more

Is there a way take existing index and create from it a new index with aggregating search? meaning taking existing index and using search to create a new aggregated index. ... View more

I want to create alert to check on all indexes event count and alert the list of all indexes that have no events in the last 24 hours ... View more

Hi, need help on how to extract dat from this JSON. i have used spath to extract a part of my JSON to get this data structure: { <"app name1">: { "reason": "all ok", "upstreams": 1, "dialouts": { "idle": 40, "total": 40, "connecting": 0 }, }, <"app name2": { "reason": "all ok", "upstreams": 2, "dialouts": { "idle": 15, "total": 15, "connecting": 0 }, }, <"app name3": { "reason": "all ok", "upstreams": 2, "dialouts": { "idle": 15, "total": 15, "connecting": 0 }, }, ..... } what i want to do is to have a table to for each i have the idle, total and connecting from "dialouts": how can i do that? ... View more

is there a way to check for a specific index on which dashboards this index is used? ... View more

I have a field that his elements looks the following: ["bedep","banjori","gameover","dyre","suppobox","necurs","unknown","conficker","kraken","emotet","mirai","virut","ccleaner"] How can I only extract the names of the threats with "" from the array on a different field? ... View more

I have 2 different fields that both contain threat names. I want to show which of the threat name are in field1 and not in field2. how do I show that? ... View more

how can i make a case condition to check if StingA is in StringB? for example StingA is "xxx.com." StingB is: "a.xxx.com." ... View more