Dear Splunkers,  Splunk server certificates on servers with splunk forwarder is expiring. is there a way to upgrade them using deployment servers. We have approx 2000 clients. do we need to upgrade all of them at once? Regards, Abhishek ... View more

Dear Splunkers, I need your help in filtering out the data which I am recieving before storing it into the indexer. Below is a sample data that I am recieving, and here I am intrested to keep data in below tags and discard others. Intrested data: <name>MACHINE_HOSTNAME</name> and <ip_address>11.22.33.44</ip_address> Sample Data: <computer><general><id>1234</id><name>MACHINE_HOSTNAME</name><network_adapter_type>XXXXXX</network_adapter_type><mac_address>XX:XX:XX:XX:XX:XX</mac_address><alt_network_adapter_type>Ethernet</alt_network_adapter_type><alt_mac_address>XX:XX:XX:XX:XX:XX</alt_mac_address><ip_address>11.22.33.44</ip_address><last_reported_ip>12.34.56.78</last_reported_ip><serial_number>XXXXXXXXXX</serial_number><udid>XXXX-XXXX-XX-XX</udid><jamf_version>10.X.0-tXXXXXX</jamf_version><platform>Mac</platform><barcode_1 /><barcode_2 /><asset_tag /><remote_management><managed>true</managed> Regards, Abhi ... View more

Dear All, Hope you all are doing fine. I am currently working on a dashboard, and would need your help to check if it is possible to split world map into EMEA, APAC and AMER Regions and then map data according to region. For example data related to France country should be mapped to EMEA region, data from Antarctica country should be mapped to APAC region, and so on. Looking forward to your inputs. Thanks !! Regards, Abhi ... View more

we have created dashboard in splunk using tabs as per below URL and its perfectly working fine. https://www.splunk.com/en_us/blog/tips-and-tricks/making-a-dashboard-with-tabs-and-searches-that-run-when-clicked.html Dashboard was created in 7.0 version but recently splunk has been upgraded to 7.3. Since upgrade we have been facing issue with the tab focus. That means, when we click on any tab, a blue line is shown under the tab to know, user is on which tab but when user clicks on another tab, blue line remain on previous tab as well as comes on new tab. That means if user clicks on multiple tabs one by one then for each clicked tab there are blue lines which becomes confusing for user. Ideally, when user clicks on new tab, blue line(focus) should get removed from previous tab and should be always be on the latest clicked tab. Issue seems to be either with tabs.css or tabs.js but we are unable to identify it. Can some one look into these two files from the above link and suggest what can be modified to rectify this error. Thanks in advance! ... View more

Hi All, I configured Splunk Mobile on my android device, and I am not able to view some of the simple dashboards i created. From connection perspective, all looks Ok. Simple supported visualizations like pie chart/line chart are not showing up on my mobile device, and i see an error: I see some erros like: 2020-01-16 13:10:38,327 ERROR [subscription_requests] [subscription_requests] [set_processing] [4022] Unable to set search to processing state search_key=12fdc9a98cfe8aa4644222d348d61bb30f21b08963101535315a812e23839e32, sid=1579176636.1149, dashboard_id=nobody/search/mobile_test, type_id=bd0093a16f1f490c55485582a661fd7ea4b36839aa1247b6b7075df4d5eb11b1/2/0, type=1, ref=, base=, id=, id_hash=None, query=index="_internal" sourcetype="cloudgateway_app_internal_log" log_level=ERROR | stats count by source, earliest_time=-1h, latest_time=now, sample_ratio=1, refresh_interval_seconds=, next_update_time=, subscribers=[u'xyz'], input_tokens={}, processing=False, roles=[u'cloudgateway', u'user'], dispatch_state=5, done_progress=1.0 source = /splunk/var/log/splunk/splunk_app_cloudgateway_subscription_requests.log sourcetype = cloudgateway_app_internal_log any suggestions how to fix it? Regards, Abhi ... View more

Hi all, We configured tabs in Splunk dashboard using below blog. https://www.splunk.com/en_us/blog/tips-and-tricks/making-a-dashboard-with-tabs-and-searches-that-run-when-clicked.html It was working fine on Splunk 7.0 and after upgrade of Splunk from 7.0 to 7.3.3, the tabs are not working anymore. We checked in Splunk answers, and found a similar issue, which was fixed by upgrade of tabs.js (as suggested in the post below) https://answers.splunk.com/answers/791943/tabs-in-dashboard.html We tried the same, but still the tabs are not working as expected. it is not accepting control tokens wiring of the tabs are not working as expectation anyone had that issue and knows how to fix it? Thanks ! ... View more

Hello all, I have Index cluster in and SH cluster in our environment. All of them are 7.x version. Now I want to add an additional Search head (v8.0) , which will talk to Index cluster but this will not be a part of SH cluster. It will act as a standalone SH, and it will contain separate data models. Will splunk support above architecture? Thanks. Regards, Abhi ... View more