Reporting

Community Activity

Data Model Acceleration My Splunk architecture is having 8 Searchheads in a cluster and 40 indexers in a cluster. If i have to accelerate the... by payal23 Path Finder in Reporting 03-27-2018 0 8	0	8
How to get saved search's last successful run time ----- ----- ------ \| fields totalrec, mydate \| search index=_internal savedsearch_name="anothersavedsearch" status="s... by angelinealex Communicator in Reporting 03-27-2018 0 8	0	8
how to forward same data to two different indexers, with the following data flow, universal forwarder to heavyforwarder to indexers before my question i want you to show my data-flow. the data-flow is like universal forwarder to heavy-forwarder and... by pranil New Member in Reporting 03-27-2018 0 1	0	1
Why are the scheduled Search results not available longer than 24 hours? Hello, I have a form that I'm using to simplify the process of taking a dashboard and converting it to a scheduled s... by caseyra Explorer in Reporting 03-26-2018 0 3	0	3
Why is the Splunk SAML SSO unable to open direct email link? Hello, Since we switched to SAML SSO, we are unable to open Splunk links directly from our email. Every time I click... by sivagct Explorer in Reporting 03-23-2018 0 10	0	10
License Utilization Report for long time Hi Team, We have allocated 500GB of data per day to index in our environment but everyday the utilization is getting... by anandhalagarasa Path Finder in Reporting 03-22-2018 0 1	0	1
embeded report shows only blank screen Hi, I have a problem with the embeded report function on splunk 7 instances. we have multiple splunk servers at diff... by seitnerm Engager in Reporting 03-20-2018 1 2	1	2
How to display a barcode for a pdf report We need help trying to generate a report with a barcode field. This is how it looks like in splunk and how we want it... by rsokolova Path Finder in Reporting 03-19-2018 0 1	0	1
Datamodel acceleration: datamodel vs. pivot command Hello, I am trying to improve the performance of some fairly complex searches within my dashboards and have come acr... by anjafischer Path Finder in Reporting 03-19-2018 3 7	3	7
Where or into which System Index - Does Splunk write logs about Orphaned Searches Hi All I would like to know into which system internal index, Source - does Splunk write logs about Orphaned Search... by PowerPacked Builder in Reporting 03-16-2018 0 2	0	2
Sendemail action not working Hello, I have scheduled a search to run every 15 mins and added the following actions when the search returns resul... by elllie New Member in Reporting 03-15-2018 0 3	0	3
Customize pdf output file Hi everyone, Good day! Is there a way to customize the the pdf template upon creating a report? Like changing the lo... by sympatiko Communicator in Reporting 03-14-2018 1 4	1	4
Why can't I change email settings when I'm logged on as admin? I'm trying to change SMTP server settings under server setting but it doesn't save the changes. I'm logged on as admi... by ihiesbkalai New Member in Reporting 03-10-2018 0 1	0	1
What is the difference between indexed real-time vs scheduled search every minute for the previous minute? I understand that indexed real-time searches are not up to the second and lag (default of 60 sec) behind a real-time ... by ndavis4 Explorer in Reporting 03-09-2018 1 3	1	3
pdf rendering doesn't work as expected Hi, Since we all know export to pdf isn't doing its job perfectly. Can anyone help me to add a new custom button to ... by surekhasplunk Communicator in Reporting 03-09-2018 1 1	1	1
How to set a dynamic time parameter to scheduled saved search? Hi Team, I have a scheduled saved search which generates the csv file on the splunk server. Everyday it runs at 7 am... by newbie2tech Communicator in Reporting 03-09-2018 0 1	0	1
複数のIPアドレスを持つレコードから任意のIPアドレスを抽出して位置情報に変換する方法についてお世話様になります。タイトルにもありますが、複数のIPアドレスを持つレコードから任意のIPアドレスを抽出して位置情報に変換する方法について教えてください。対象レコード（例） Jan 31 13:42:43 192.168.xx.... by saitotakanori Engager in Reporting 03-07-2018 0 2	0	2
Why are my searches becoming unscheduled but still have a schedule configured? I have some searches that are configured using a normal cron schedule. However, they have stopped running. When view... by David_C Engager in Reporting 03-06-2018 2 1	2	1
Host is not available in Data Model (Web), but displays when using pivot from same Datamodel NO RESULTS from the following: \| tstats summariesonly=false count FROM datamodel=Web WHERE (Web.action=block) ... by gibronda Explorer in Reporting 03-05-2018 0 0	0	0
Cronjob for 48 hours How to set report for every 48 hours. What should be cronjob for that. If I am set "* * /2 *". It can run at ever... by N92 Path Finder in Reporting 03-02-2018 0 1	0	1
List of all Admin Users report I have the search to list the Admins in Splunk. I need to have it as a saved search or dashboard a non-Admin can sav... by dcrooks_cbp New Member in Reporting 03-01-2018 0 3	0	3
Report scheduling/acceleration question... Hi, I need to generate a number of reports about license utilization for different customers, over the past 30 days.... by a212830 Champion in Reporting 02-26-2018 0 5	0	5
scheduled job fails with status=delegated_remote_error Hi , One of the scheduled search fails at the time9and even changed) with this error in scheduler.log status=deleg... by Mohsin123 Path Finder in Reporting 02-26-2018 0 2	0	2
Web link accessed on Firewall My Query is little different, I need to find the access status of web links on firewall/proxy logs of the access stat... by deepak007 Explorer in Reporting 02-22-2018 0 2	0	2
where can I see if my saved search/report is running as "owner" for another user who do not have access to index. hi, I am trying to restrict a user with role no access to any indexes and trying to share a report at app level( wit... by sgundeti Path Finder in Reporting 02-20-2018 0 5	0	5