I am new to splunk, and trying to understand what’s the difference between dispatch.earliest_time = "-15m@m" and dispatch.earliest_time = "-15m”. Thanks!
...sing CLI about enabling/disabling correlation search. I mean, I just want to change many rules and many apps to "disabled = 0" or "disabled =1" in savedsearch.conf using CLI(like shell). I a...
Given a specified n number of csvs, I want to input and append them:
| makeresults | eval count=mvrange(0,n,1) | mvexpand count | eval filename=strftime(relative_time(now(),"-"+tostring(count)+"m...
...es.conf file I have disabled = 1, I want to retrieve that value)
2) How is the search scheduled? - (in the savedsearches.conf file I have cron_schedule = 0 */12 * * *, I want to r...
Hello all,
I'm trying to define splunk saved-search using the splunk CLI.
In order to enable scheduling of a saved search, I identified the option "enableSched" in the savedsearch.conf. I w...
...pp to use
{% savedsearchmanager %}
id="name_of_this_manager"
searchname="Name of Saved Search"
app="search" %}
My saved search is supposed to run every 6 hours, however when I t...
...rocess]
for this I am unable to get Email alert, following I have added in savedsearch.conf file
action.email = 1
action.email.inline = 1
action.email.sendresults = 1
action.email.to = m...
I use Splunk 6.2. I have few scheduled searches that creates summary index. I need them to run on time (Not continued), So i changed the realtime_schedule value to "1" in savedsearches.conf. E...
I created a simple dashboard as PDF delivery schedule and it wrote it to the savedsearches.conf in my user folder.
But I need it to part of the app so I can deploy it to another search head.
W...