| | The "monitor a file or directory" data input option is no longer working. When I add a new file this way, the source ... 0 1 | 0 | 1 | |
| | Do you have any readily available scripts that I can use? 0 3 | 0 | 3 | |
| | I've got a log file that contains, time, controller, and CPU % used. I need to create a time chart that plots the CPU... 0 3 | 0 | 3 | |
| | I have a script that gathers disk freespace metrics and indexes these metrics into splunk every 10 minutes. This i... 0 4 | 0 | 4 | |
| | I don't have a clue anymore. My data hasn't been indexed anymore. I attempted all the three ways of Files & Directori... 2 4 | 2 | 4 | |
| | Hey, I have been searching through the vast module reference and have not been able to find a specific <param...> W... 1 4 | 1 | 4 | |
| | If a LWF has a large number of files to monitor, what settings can be used to help ensure that consuming/monitoring t... 3 2 | 3 | 2 | |
| | We have a LWF on Linux that is forwarding to our indexer. We're a little tight on space, but in my experience the LWF... 1 3 | 1 | 3 | |
| | Since I usually turned of splunkd service on my local machine and only turn it back on when I need to do some log sea... 0 1 | 0 | 1 | |
| | This is probably pretty straightforward but on my search head the following will not return any results: index=train... 1 1 | 1 | 1 | |
| | Sorry for the cross post but after posting i saw a recommendation to use this forum instead of splunk.com I am havin... 1 6 | 1 | 6 | |
| | I'm trying something that's probably pretty simple. When I use the dashboard editor to make a dashboard consisting of... 1 2 | 1 | 2 | |
| | I just downloaded and installed splunk 4.1.4 and installed on WIN7 laptop. Upon reboot of my system, the CPU pegged ... 1 8 | 1 | 8 | |
| | I have a fschange stanza configured as such [fschange:/path/to/file] disabled = false pollPeriod = 300 fullEvent = t... 1 3 | 1 | 3 | |
| | Got the following: One field with 4 types of values/functions and another field that is the status of those functions... 0 2 | 0 | 2 | |
| | I know that from version 4 onward, use of the earliest and latest time parameters are preferred over the older startm... 1 1 | 1 | 1 | |
| | I'm following the instructions here and can't get it to even recognize the lookup. Did I miss something? My transfor... 1 8 | 1 | 8 | |
| | Does anyone know if the Splunk for IMAP app support indexing attachments? For example, when setting up the Splunk f... 0 3 | 0 | 3 | |
| | I'm trying to create a table which shows the following: - Domain Client_IP Client_User Cou... 0 4 | 0 | 4 | |
| | Hey, How would I go about writing a search that is able to show me how many events are found in a particular index (... 0 6 | 0 | 6 | |
| | I've been using the default "main" index for all my indexing. I'm at the point where I think it would be best to bran... 1 5 | 1 | 5 | |
| | Hi... I'm trying to import 'thousands' of old event logs into Splunk to setup a searchable database.... I can enter... 2 3 | 2 | 3 | |
| | I would like to migrate my indexed data from Splunk 3.3.4 on a Sparc Solaris 10 platform to Splunk 4.1.4 on a Linux (... 0 2 | 0 | 2 | |
| | I have a view with 2 blocks (similar but different in layout) on the page that look like this. <module name="Nul... 2 2 | 2 | 2 | |
| | Is it possible to pass a replacementMap argument through a viewRedirector link? If that's a mangled question, what... 2 3 | 2 | 3 | |
