Find Answers

Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

Category Activity

How to optimize performance for scripted lookups? I would like to use a lookup into an external database to add fields to my events, but need some advice about perform... by Justin_Grant Contributor in Splunk Search 03-15-2010 2 3	2	3
What are the defaults for the dbinspect command? On the Search App > Status > Index activity dashboard, there is an Index health report showing the bucket spread over... by hulahoop Splunk Employee in Splunk Search 03-13-2010 1 1	1	1
I've installed Splunk on windows, and I see splunk-wmi.exe and splunk-regmon.exe programs. What are these? Can I turn them off? Installed Splunk on Windows machine and in the task manager I see these two processes running by default. How can I ... by elusive Splunk Employee in Getting Data In 03-13-2010 2 2	2	2
When should I use a FIFO for an input? I notice there is support for fifo's as inputs. Are there any benefits to using a fifo or is it just support for thos... by Erik_Swan Splunk Employee in Monitoring Splunk 03-13-2010 1 2	1	2
Any way to reduce the storage footprint of a Windows LWF in 4.0? I've reduced the log retention timeout so that the disk footprint doesn't grow. Is there any way to remove anything ... by dskillman Splunk Employee in Deployment Architecture 03-13-2010 2 2	2	2
Trying to combine two regexes into one I'm trying to throw out search results from a couple of different ip ranges. Currently I'm working with 2, but I mig... by thepocketwade Path Finder in Splunk Search 03-12-2010 3 4	3	4
How can I find out what events get sent to the nullQueue when I try to filter events on a forwarder? Hi I am trying to filter events on a LightWeightForwarder, but they don't get dropped. Is there a way to debug this?... by chris Motivator in Getting Data In 03-12-2010 1 4	1	4
"The specified search is too large." Can somebody help me figure out what "too large" is? A query to count tag=pci entries by eventtype (and happens to be part of the application): tag=pci \| stats count by ... by Nate_Schmoll Engager in Knowledge Management 03-12-2010 4 5	4	5
How do I set the default PAGE, instead of just the default app? I've followed the instructions on http://www.splunk.com/base/Documentation/4.0.9/Developer/DefaultApp to set the defa... by oreoshake Communicator in Monitoring Splunk 03-10-2010 6 2	6	2
Timestamp logic/config on forwarder or indexer? I looked at the report for timestamping errors and found a fair amount of errors. I’ve been following the Splunk blo... by oreoshake Communicator in Monitoring Splunk 03-10-2010 0 5	0	5
Can Splunk decode data at index time? If I have a field value that is URL encoded then base-64 encoded, is it possible to have Splunk decode this field bef... by hulahoop Splunk Employee in Getting Data In 03-10-2010 3 7	3	7
Is it possible to include metadata in keyword searches? It is a subtlety of the search language that keyword searches run against the raw event data only. To search metadat... by hulahoop Splunk Employee in Splunk Search 03-09-2010 1 2	1	2
What is the difference between a lightforwarder and a regular forwarder? Apart from the fact that a lightforwarder does not have a web UI, what are the main differences between the 2 apps? by Mick Splunk Employee in Getting Data In 03-09-2010 0 2	0	2
How can I limit the number of results that can be returned in a search (in UI)? I'd like to limit certain users from running expensive searches by limiting the number of results that can be returne... by the_wolverine Champion in Splunk Search 03-09-2010 2 1	2	1
Data from forwarder arrives at the indexer but does not get indexed Hi I have set up a light weight forwarder that appears to be getting data to the indexer. But I can't search for an... by chris Motivator in Getting Data In 03-05-2010 2 2	2	2
What time format do I use when setting srchTimeWin (in authorize.conf)? I'm trying to configure a search Time Window for my Splunk roles. I've read the documentation but can't find instruc... by the_wolverine Champion in Installation 03-05-2010 1 1	1	1
How do I change the default granularity on a chart? How do I change the default granularity on a chart? It appears I'm hitting a limit somewhere and I'm not getting as ... by dskillman Splunk Employee in Splunk Search 03-04-2010 5 2	5	2
How to open a log file with Splunk from Windows Explorer? While I browse my local drive in Explorer I would like to add and search some log files with Splunk without opening a... by Leo Splunk Employee in Splunk Search 03-03-2010 1 1	1	1
Incorporate something like this into a Splunk search builder (module)? There are some who are really good at regular expression, some okay, and the rest who downright are lost beyond a spl... by matt_1 Explorer in Splunk Search 03-03-2010 2 1	2	1
ERROR SavedSplunker - No record for that user Seeing this error in splunkd.log on a splunk indexer when running a saved search. What does it mean? by Jaci Splunk Employee in Monitoring Splunk 03-01-2010 2 1	2	1
AD is only returning 1000 entries. How do I get around this? I'm trying to configure LDAP auth for Splunk. I'm running into an issue where AD is only giving me 1000 entries and ... by the_wolverine Champion in Security 02-27-2010 2 2	2	2
maxresults and stats command Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a sear... by kbecker Communicator in Splunk Search 02-26-2010 2 1	2	1
How do I search across a specific or custom time range within each hour of the day? I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment a... by maverick Splunk Employee in Splunk Search 02-24-2010 1 1	1	1
Estimating storage requirements on a windows server In the installation manual it shows how once you have indexed some data by using the "du -shc hot_v*/rawdata" command... by Scott Engager in Installation 02-23-2010 1 1	1	1
Can I replicate a subset of the data to a non-Splunk destination? I need to do the following on my forwarder: Forward all data received and gathered by the forwarder to Splunk indexe... by Alan_Bradley Path Finder in Getting Data In 02-23-2010 1 1	1	1