OK, I assumed you were the admin on the Splunk instance. If you are not, then you will not be able to follow this approach as it needs multiple steps to be performed at the backend including adding new js/css files. You may approach your Splunk admin and let them evaluate this solution. I've also converted by answer to a comment as it does not solve your problem. You may also consider adding all the panels from the three dashboards into a single one and then controlling the visibility of those panels using a token set by your drop down. It is not a very clean approach but if you really need it, it may be helpful. doc here ... View more

Hi Nandhini, The choice of OS running Splunk Enterprise really does not matter in the montioring of the AD server. As the monitoring metrics, events, logs are all captured by the Universal Forwarder (which will be for the specific OS version where your AD is installed) The approach I am suggesting is this. In this approach your Splunk Enterpise can be installed on any OS platform. AD Server ( Splunk UF with AD addons) --------> Splunk Enterprise (Indexing, Alerting and Dashboarding) The article you had linked is fundamentally different as it is considering installing Splunk Enterprise on your AD server itself, which to be fair will not be scalable as you may have many AD servers in the future. I'm afraid that for exact differences in both approaches, you may have to read through the notes in the documentation. Hope this helps. ... View more

Are you trying to identify latency between the events getting generated and the time that they are indexed? ... View more

Found a similar question to yours. Please check if this applies to your scenario. https://answers.splunk.com/answers/137728/is-there-any-meta-data-that-identifies-when-a-splunk-agent-was-first-installed.html ... View more

I am not clear on the exact issue but it looks like a problem with the user account on the server. You may want to check the privilges with your CentOS admins. Are you able to resolve the Indexer names to get the IPs if you run a nslookup command while logged in as that user? ... View more

The cron schedule in inputs.conf will use the time zone that is set for the user account running Splunk Enterprise or UF. So you will need to create the schedule based on that TZ. ... View more

Are you fine with having tabs for each of your dashboard? If yes, then you can try using this method described on the blog post Making a dashboard with tabs This will give you the functionality of having multiple sets of panels under each tab which will be loaded when you click on them. We had a similar requirement to have a master dashboard and this is how we solved it for our use case. ... View more

Can you elaborate what you mean by "same regex is not working on Splunk"? One problem may be that you are not using any names for the groups, so Splunk does not know what to name the field. Also, if you need multiple matches, try using the max_match option. ... View more

If 2 out of 3 SH nodes were down, the your cluster was not "working". So the SH Captain was not able to reach the other Search Heads which can cause connection refused errors. Did you have the error after starting the 2 nodes that were down? You can see your cluster's running status by running this command on any SH cluster member. $SPLUNK_HOME/bin/splunk show shcluster-status ... View more

I had a similar problem where the Service Now add-on was not extracting the fields when I was looking at the events in Search. The reason I found was that a limit is applied on Field Extractions while searching. By default, after 10000 characters (if i remember the value correctly), Splunk will stop identifying new fields. In case your issue is the same, you have 2 options: Increase the limit from 10000 to something much larger (not recommended in most cases) Update the inputs for tables that you have enabled in the Service Now add-on to Exclude certain fields that have long string data. e.g. Comments & Work Notes for Incidents. I used the 2nd approach and was able to get the extraction to work properly. ... View more

Have you tried creating two separate searches and appending their results together. It may be able to do the job you want. ... View more

Have you checked the cron schedule for the DBConnect DataLab? Also, is DBConnect app showing any errors? We had an issue where the port used by DBConnect was not running and so it had stopped executing the data labs. The dashboard running slowly should not be related to the DBConnect application as it will be fetching events from the Index and not the app. You might want to check if you have any performance issues on your Indexer(s). ... View more

This path will only have the csv lookups. $SPLUNK_HOME/etc/apps//lookups The KV lookups can only be accessed from the UI or via REST API. And that would require a valid license. ... View more

We could not find a way to do it via Alert Manager. So we created an external script to resolve the alerts after creation. ... View more