Hey, I have a 16-core windows 2003 server running Splunk v4.3.1 which is used for both searching and indexing. On this particular server, there have been a couple occasions recently during daily peak periods of indexing where the UI has slowed down with the splunk daemon not being reachable. During these periods, there is lots of data coming into Splunk via UDP. Does anyone have any tips of what can be done to ensure that the Splunk UI can still be used in these peak indexing periods? (that does not involve introducing more hardware) I've noticed that during these busy periods, the server only appears to be making decent use of 2/3 cores of the available 16. Is this normal? If not, can this be changed? Any ways in which we can improve indexing throughput/efficiency would be very useful. Thanks in advance for your help. ... View more

Hey, I have an instance of Splunk which is not functioning as desired. When I execute a search in the flashtimeline view, results will only be returned when the search starts with index=the_index ... If I do not specify the index at the beginning of the query but instead choose to start the search query with something that resides in an index (e.g. * OR env="uat") this will swiftly returns no results when it is executed. Is there a parameter in the config somewhere which is causing this behaviour where search queries only return results when they begin with index=the_index ? Thanks in advance for your help. ... View more

Hey, When I receive a Splunk alert, the email contains the Splunk search query which was executed in order to trigger the alert. How do I stop the search query from being included in the body of the email alerts that get sent out? Thanks in advance for your help. ... View more

Hi, In the $SPLUNK_HOME$\var\log\splunk directory, there are a handful of .dmp files which are relatively large in size. An example of one such named file is C__Program Files_Splunk_bin_splunkd_exe_crash-2012-01-01-01-01-01.dmp . There is also a matching .log file. Is it safe to delete these files? Thanks in advance for your help. ... View more

Hi, I am aware that you can permanently erase data from an index by typing the following command via CLI: splunk clean eventdata the_index This would erase ALL data from the_index . If I wanted to erase all events from the_index that were indexed on a particular date (e.g. 1st October 2012), how would I do this? Thanks in advance for your help. ... View more

Hi, I want to set a limit on how far back you can retrieve data from. E.g. I don't want users to see data before September 1st 2012 so if they choose 'Last 30 days' on the standard timerangepicker, it will not return data before September 1st 2012 although data exists for August 31st 2012. Is there a way of achieving this behaviour? Thanks in advance for your help. ... View more

Hi, I have a view with a chart that uses the timerangepicker module. The index which is used to display data in this chart has data going back as far as January 2012. However, I only want to be able to use the timerangepicker to return data from July 2012. The two cases I am seeing are as follows: 1) If I try to add the earliest param to my hiddensearch for this chart, the timerangepicker does not work at all when the hiddensearch is inside the timerangepicker module code. 2) If I place the timerangepicker inside of the hiddensearch module code, then the earliest param is ignored when I set the timerangepicker to 'All time' What I would like is that no mattter how far back you set the timerangepicker, it will not return data prior to July 2012. So if I choose 'All time' the chart will not return the data from January through June 2012 end. Is there a way of getting this behaviour in a view? Thanks in advance for your help. ... View more