Hello everyone! When I searched in the search header, I used the earliest, latest command, but it didn't work. Usually the earliest and latest commands have priority over the time range on the right side of the GUI. I ran the same search in the indexer just in case, but the indexer works with the earliest and latest commands. I really want to find a solution to this problem. Thanks. ... View more

Hi All, I am a newbie in Splunk world and looking for some help in structuring my query. I have an index with data like this -   index=sec_sso sourcetype=sso_insa earlist=-1d@d latest=now | eval Day=if(_time<relative_time(now(), "@d"), "Yesterday", "Today") | eventstats count by EMINO DPRTM_NAME | search count=1  | table EMINO DPRTM_NAME Day   If there is only today's value (new registration), I want to change this query to exclude that value.  ... View more

Hello everybody I installed Microsoft Azure Add on for Splunk (https://splunkbase.splunk.com/app/3757/#/details) and connected it with Metrics in Azure. However, only a few metrics are linked. The most important NATGateway Metric (Microsoft.Network/natGateways) does not work. I hope the helper appears in my two questions.   1. Is there a way to get NATGateway data using Microsoft Azure Add on for Splunk?   2. Recommend other add-ons to integrate NATGateway.   Thank you. ... View more

Hello! I ask you to check if the props.conf I wrote is appropriate.   1. Data {"subscription_id": "ec7d6887-675d-46d6", "maximum": 109133.0, "namespace": "microsoft.dbformariadb/servers", "unit": "Bytes", "_time": "2020-10-29T06:36:00Z", "average": 109133.0, "host": "/subscriptions/ec7d6887-675d-46d6/resourceGroups/RG-T/providers/Microsoft.DBforMariaDB/servers/azure-mariadb", "metric_name": "serverlog_storage_usage", "minimum": 109133.0}    2. index="_internal" host="VM-KC" log_level!=INFO (*fail* OR *extract*) ARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Thu Oct 29 14:02:00 2020). Context: source=azure_metrics://MariaDB|host=VM-KC|azure:metrics|   3. Line Breaking Error ERROR LineBreakingProcessor - Line breaking regex has no capturing groups: \}\} - data_source="/monitoring/scouter/server/ext_plugin_filelog/scouter-counter-javaee.json", data_host="VM-KC", data_sourcetype="scouter_json"   4. Timestamp Parsing Error A possible timestamp match (Fri Sep 10 00:41:19 2010) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. WARN DateParserVerbose - A possible timestamp match (Fri Sep 10 00:41:19 2010) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=azure_metrics://MariaDB|host=VM-KC|azure:metrics| <props.conf Sample>  index = "azure" source = "azure_metrics : // MariaDB" sourcetype = "azure : metrics"  [source :: azure_metrics : // MariaDB] DATETIME_CONFIG = CURRENT BREAK_ONLY_BEFORE_DATE = true NO_BINARY_CHECK = true MAX_TIMESTAMP_LOOKAHEAD=200     ... View more

I am trying to add Splunk sdk and gradle is failing to sync with Cause: javacTask I will add the stacktrace. I have mint-android-repo-5.2.5.zip folder under app folder (so it is app > mint-plugin-repo-5.2.5) I am using Android studio 3.4, and below is my gradle file. apply plugin: 'com.android.application' apply plugin: 'com.splunk.mint.gradle.android.plugin' apply plugin: 'kotlin-android' apply plugin: 'kotlin-android-extensions' apply plugin: "kotlin-kapt" buildscript { repositories { maven { url uri('mint-plugin-repo-5.2.5') } mavenCentral() } dependencies { classpath 'com.splunk:mint-gradle-android-plugin:5.2.5' } } repositories { maven { url uri('mint-plugin-repo-5.2.5') } } stack trace Caused by: java.lang.NoSuchFieldError: javacTask at com.splunk.mint.gradle.android.plugin.utils.VariantUtilsKt.getJavaTask(VariantUtils.kt:13) at com.splunk.mint.gradle.android.plugin.api.AspectJTransform.setupVariant(AspectJTransform.kt:81) at com.splunk.mint.gradle.android.plugin.api.AspectJTransform$prepareProject$1.execute(AspectJTransform.kt:57) at com.splunk.mint.gradle.android.plugin.api.AspectJTransform$prepareProject$1.execute(AspectJTransform.kt:43) at org.gradle.configuration.internal.DefaultListenerBuildOperationDecorator$BuildOperationEmittingAction$1$1.run(DefaultListenerBuildOperationDecorator.java:150) at org.gradle.configuration.internal.DefaultUserCodeApplicationContext.reapply(DefaultUserCodeApplicationContext.java:58) at org.gradle.configuration.internal.DefaultListenerBuildOperationDecorator$BuildOperationEmittingAction$1.run(DefaultListenerBuildOperationDecorator.java:147) at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:402) at org.gradle.internal.operations.DefaultBuildOperationExecutor$RunnableBuildOperationWorker.execute(DefaultBuildOperationExecutor.java:394) at org.gradle.internal.operations.DefaultBuildOperationExecutor$1.execute(DefaultBuildOperationExecutor.java:165) at org.gradle.internal.operations.DefaultBuildOperationExecutor.execute(DefaultBuildOperationExecutor.java:250) at org.gradle.internal.operations.DefaultBuildOperationExecutor.execute(DefaultBuildOperationExecutor.java:158) at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:92) at org.gradle.configuration.internal.DefaultListenerBuildOperationDecorator$BuildOperationEmittingAction.execute(DefaultListenerBuildOperationDecorator.java:144) at org.gradle.internal.event.BroadcastDispatch$ActionInvocationHandler.dispatch(BroadcastDispatch.java:91) at org.gradle.internal.event.BroadcastDispatch$ActionInvocationHandler.dispatch(BroadcastDispatch.java:80) at org.gradle.internal.event.AbstractBroadcastDispatch.dispatch(AbstractBroadcastDispatch.java:42) at org.gradle.internal.event.BroadcastDispatch$SingletonDispatch.dispatch(BroadcastDispatch.java:230) at org.gradle.internal.event.BroadcastDispatch$SingletonDispatch.dispatch(BroadcastDispatch.java:149) at org.gradle.internal.event.AbstractBroadcastDispatch.dispatch(AbstractBroadcastDispatch.java:58) ... 126 more ... View more