What he said ^ . Also try simply using epoch time, the UI can be misleading ... View more

Interesting. So perhaps this remains un-answered? ... View more

Can't believe I didn't see this. So I guess this is possible but no way to know for sure or replicate. I wonder if this is the only case in which a search head chooses a bucket primary. You should convert this to your answer and I'll hit accept. Thanks! ... View more

Some different wording and perspective. A single search cluster in site 0 is searching for identical data in a multisite indexer cluster with 2 sites. If two search heads receive a request at the same time to search for the same data, does only one indexer serve that request or can one from each site serve one search head each, concurrently, and how does the master decide since both buckets are primary for their site? ... View more

I'm also getting the cannot find dbxquery error after upgrading to 6.3. Wasn't an issue pre 6.3. I have, in this particular deployment, 1 search head, 2 indexers and a master similar to you but without heavy forwarders. Prior to 6.3 I didn't need the app on the indexers. It seems now that in 6.3 more things are published in the distributed search bundle than before? It's like more search functions have now been moved to the indexing tier (probably to better enable parallel processing pipelines?) I haven't gotten to forcing the app on my indexers as a workaround like you've done and it seems that won't do me much good anyway. The way I understand it is the recommended way to use dbconnect is on an ad-hoc searcher, not part of your cluster and not a distributed searcher of your indexers but as a heavy forwarder instead. I don't see many people do this because how are your lookups going to work? For your solution, I'd recommend configuring dbconnect solely on your heavy forwarders and even have a third instance running the RPC to avoid duplicate queries. For now, I've gone back to dbconnect v1 where possible on 6.3 instances which seems to work just fine. ... View more

Seeing something similar in one of my deployments. Standalone search head talking to two clustered indexers.\ DistributedPeerManager - Unable to distribute to peer named at uri https://:8089 because replication was unsuccessful. replicationStatus Failed failure info: failed_because_BUNDLE_DATA_TRANSMIT_FAILURE Same is happening on the second indexer too. ... View more

@richgalloway is correct, you need to wrap your regex in a capturing group, () ... View more

Per http://docs.splunk.com/Documentation/DBX/2.0.4/DeployDBX/Architectureandperformanceconsiderations SH Clustering is supported. If using an RPC server as suggested, DBConnect 2 SHOULD work in theory. ... View more

I also have/had this same problem. I had three people look to make sure I wasn't crazy. I finally got it working by installing the most up to date version, changing my timestamp to char type in my query, and then inputting my format string, backing out, then back in and clicking save about 3 times. Sounds crazy but its definitely a bug that needs looking at. ... View more

You should at least add yourself to the winfra-admin role in Settings > Access Controls > Roles. ... View more

Try this. Any results? index=vulnerabilities sourcetype=nessus | join type=inner _time,dest [search index=vulnerabilities | rex field=plugin_output "(?i)resolves\sas\s(?P<hostname>[^\.]+)\.(?P<domainname>\S+)?\." | eval hostname=if(isnull(hostname),dest,hostname) | fields hostname] ... View more

The same applies even for ad-hoc searches. You can configure a global default ttl for all searches if needed in your limits.conf under [search] ttl = * How long search artifacts should be stored on disk once completed, in seconds. The ttl is computed * relative to the modtime of status.csv of the job if such file exists or the modtime of the search * job's artifact directory. If a job is being actively viewed in the Splunk UI then the modtime of * status.csv is constantly updated such that the reaper does not remove the job from underneath. * Defaults to 600, which is equivalent to 10 minutes. default_save_ttl = * How long the ttl for a search artifact should be extended in response to the save control action, in second. 0 = indefinitely. * Defaults to 604800 (1 week) remote_ttl = * How long artifacts from searches run in behalf of a search head should be stored on the indexer after completion, in seconds. * Defaults to 600 (10 minutes) ... View more

You can set the expiry of the saved search under Settings > Searches reports and alerts. Click the search you want to edit, scroll down to expiration and set a custom time. ... View more

Checking in, my cluster is still alive. Anyone know where this was officially patched? ... View more

I think Martin is right here. Looks like you're simply rolling buckets. ... View more

Look at the custom link switcher at {{SPLUNK_URL}}/en-US/app/simple_xml_examples/custom_link_switcher ... View more

UniversalForwarder+Windows-Permissions=HELL Make sure you have adequate permissions to do all things specified on the forwarder. Not a complete solution but a good place to start. ... View more