Find Answers

Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

Category Activity

Remove annoying restart messaging I don't want to restart splunk right now, but the UI is giving my and my users an annoying message saying I need to r... by benstraw Splunk Employee in Deployment Architecture 01-27-2010 2 2	2	2
How can summary indexing help improve the performance of my dashboards and reports I have a report on my dashboard that takes a very long time to build, how can I use summary indexing to improve the p... by benstraw Splunk Employee in Dashboards & Visualizations 01-25-2010 0 3	0	3
How do I search for a single specific event? Sometimes I come across an event in my index that I'd like to refer to later, either as part of an investigation or t... by Johnvey Contributor in Splunk Search 01-25-2010 1 3	1	3
performance characteristics of dedup command I'm thinking about using the DEDUP commend to solve the following problem: I have an event with an ID field and I'd l... by Justin_Grant Contributor in Monitoring Splunk 01-22-2010 2 1	2	1
I know the data is in the index, why didn't my scheduled search find all of the events? I have a saved seach setup to check every minute for file changes. I have the start time set for [-1m] to search bac... by Mick Splunk Employee in Splunk Search 01-22-2010 2 1	2	1
suppressing adjacent events with duplicate field values I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where ... by Justin_Grant Contributor in Splunk Search 01-22-2010 0 2	0	2
Will having lots of extracted fields increase my index size? I need to understand how adding fields to raw data will increase our index size growth. We are in the process of addi... by Mick Splunk Employee in Splunk Search 01-21-2010 2 1	2	1
How do I share all of the field extractions defined in a given app with all other apps? I need to share all of the field extractions in my app with all of the other apps on the system. What is the most ef... by matt Splunk Employee in Splunk Search 01-21-2010 2 5	2	5
What is the format of the Sources.data file? $SPLUNK_HOME/var/lib/splunk/defaultdb/db/Sources.data On a fresh install I see this file has something like this: ... by matt Splunk Employee in Splunk Search 01-21-2010 1 2	1	2
Can I monitor Windows Registry with Splunk? Are there ways in Splunk to monitor and index any activity on Windows Registry? by Ledio_Ago Splunk Employee in Getting Data In 01-20-2010 2 1	2	1
RSS feed links to a file not found page I set up an alert action to create an rss feed and there is an rss link in the table view of all of my saved searches... by benstraw Splunk Employee in Reporting 01-20-2010 2 1	2	1
Feature Request: troubleshooting/debugging for field extraction config files [UPDATE: from the answer below, it sounds like what I'm looking for is not supported in the product today. I'm tackin... by Justin_Grant Contributor in Splunk Search 01-20-2010 18 2	18	2
What sort of hardware should I use for my splunk install? I will have 100GB coming in per day, with an expectation of 20 concurrent users at any given time, with probably arou... by jrodman Splunk Employee in Monitoring Splunk 01-20-2010 2 1	2	1
What salts the password hash? What private key pairs are used to generate the hashed passwords in authentication.conf or the passwd file? by matt Splunk Employee in Security 01-15-2010 1 1	1	1
How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes? I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applicati... by jrodman Splunk Employee in Getting Data In 01-15-2010 2 1	2	1
How do I set a hostname? What do I need to do to set the correct hostname for an event? by matt Splunk Employee in Getting Data In 01-15-2010 2 3	2	3
Finalize action for searchscript? I wrote a search operator that takes actions external to splunk. It has to take an action to 'complete' its operatio... by jrodman Splunk Employee in Splunk Search 01-15-2010 2 2	2	2
My coldtofrozen script seems to hang splunk, what can I do? When my selected coldToFrozenScript runs, which can take 10 minutes, the splunk search interface stops working until ... by jrodman Splunk Employee in Getting Data In 01-15-2010 0 1	0	1
Why do my email alerts have garbled headers? I am using Splunk 4 and the email alerts that are sent to me have a bunch on junk in the 'To' and 'From' lines, like:... by Johnvey Contributor in Alerting 01-14-2010 2 1	2	1
historical data on a new installation I just installed splunk and indexed a log file with data that is from earlier this year, The summary dashboard shows ... by benstraw Splunk Employee in Knowledge Management 01-14-2010 1 1	1	1
How do I allow users to edit a view? If our users navigate to Manager --> Views they can see all the views, but they do not have permissions to edit or ad... by matt Splunk Employee in Security 01-14-2010 1 1	1	1
I can't see data I know is indexed I have data indexed but the "all indexed data" dashboard module is empty. Searching for * over all time produces no r... by cfrln Explorer in Getting Data In 01-14-2010 2 2	2	2
how to tell if I have multiline events? Because wc -l of the input doesn't match my event count, and I'm trying to troubleshoot. by V_at_Splunk Splunk Employee in Splunk Search 01-14-2010 1 2	1	2
How do I use the SingleValue module to color code search results? In discussions, Johnvey has suggested to use the SingleValue module to display the output of the results. In fact, wi... by tpaulsen Contributor in Dashboards & Visualizations 11-04-2009 4 2	4	2