Both SH and Indexer cluster is there. I have configured Splunk -ITSI with servicenow , after configuring we found that duplicate events are coming in itsi_tracked_alerts and itsi_grouped_alerts indexes ... View more

All servers mentioned that are sending data to perfmon index in cluster 1 are DNS and AD servers.So, they are sending directly to the cluster.I have tried turning off the perfmon inputs but still we are receiving data on the index ... View more

Hi, I have 2 values category and sub category . Sub category is dependent on category . so I have created lookup to get these values in dropdown.. I just want to remove below error below the sub category field.   ... View more

 I have added  below  add to SH's props.conf . it still not working [iis] BREAK_ONLY_BEFORE = ^\d{7} BREAK_ONLY_BEFORE_DATE = CHECK_FOR_HEADER = true DATETIME_CONFIG = EVAL-action = "allowed" EVAL-app = "iis" EVAL-http_content_type = "text/html" EVENT_BREAKER = .+ INDEXED_EXTRACTIONS = w3c LINE_BREAKER = ([\r\n]+)\d+-\d+-\d+\s\d+:\d+:\d+ MAX_TIMESTAMP_LOOKAHEAD = 32 NO_BINARY_CHECK = true SEDCMD-cs_Cookie = s/(?<cs_Cookie>[\w]+=[^\s]+)/*******/g SEDCMD-cs_Referer = s/(?<cs_Referer>[\w]+:\/\/[^\s]+)/*******/g SEDCMD-cs_uri_query = s/(?<cs_uri_query>\w+=[^\s]+|(\w+=))/*******/g SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%d %H:%M:%S TIME_PREFIX = ^ TRUNCATE = 0 TZ = UTC category = Custom description = W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server detect_trailing_nulls = auto disabled = false pulldown_type = true EVAL-cs_Cookie = null() EVAL-cs_Referer= null() EVAL-cs_uri_query= null() ... View more

@ansif Rahman and @KamleshVaghela. Hi ,Can you please provide any solution for this. i am not able understand how this correlation ID is working while doing Servicenow Integration.Please help ... View more