I don't believe this is a possibility unless the field is part of your result set and if I'm correct, only fields part of a split-by clause end up here. ... View more

Report acceleration is excellent for rendering massive or sparse data sets quickly. You will see near instant results from an accelerated search. Report acceleration performed on a search head cannot benefit another unless you're using search head clustering. ... View more

Are you doing this in a distributed environment? ... View more

Where did you set this config? I'm seeing similar issues on one of my indexers. ... View more

You'll need to configure this in the parsing phase. The indexer is essentially also a heavy forwarder so this applies here as well. http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Routeandfilterdatad ... View more

I suggest taking a look at creating default fields dynamically in http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Assignmetadatatoeventsdynamically . From here you may be able to create a new field called "forwarder" maybe? and assign the forwarder's hostname variable to the transforms for the field. ... View more

Have a look at the reference docs on lookup. Tokens aren't the real focus here. Take a look. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup ... View more

This is no longer supported in 6.2.* . Splunk we need this capability back! ... View more

It'd be pretty expensive to do indexing and throughput wise but you could set your input intervals very low, like 1-10 seconds. Deploy the new inputs to your forwarders during your QA and then run real-time searches on the data coming in. Anything you don't need to monitor with that much granularity afterwards should be adjusted back to a longer interval. ... View more

The lookup file editor app would be a good solution to allow user to easily edit. ... View more

I don't see any known bugs like this in the 6.1* release notes. Can you try to find the defect # for this bug? Otherwise my instinct leans me towards app level permissions. Out of the UI, you gotta get it out of the users directory and into the app directory. May be best to simply copy and paste the dashboard XML into a new view instead of devote too much time to it. ... View more

I personally would use a lookup table to achieve this. Place this data into a csv and import as a lookup file, create a lookup definition for it then if you like create an automatic lookup so you never need to do it again. ... View more

You can use convert() to achieve this. Syntax convert timeformat=string... Required arguments Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit() Description: Functions for convert. ctime() Syntax: ctime( ) Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to. ... View more

As as user with power level or greater permissions you can clone the dashboard then share the clone. Otherwise your user needs elevated permissions to be able to share out his dashboard. ... View more

You can use form inputs (multi select) to assign search language to a token. Basically you'd be writing the main part of the search in a token. In the multi select menu, you can set your dropdown list labels to whatever label you like and the values for each would be your search string. Then place the tokens in your dashboard panel searches to populate them Multiselect Options; CSV1 > |inputlookup csv1.csv CSV2 > |inputlookup csv2.csv ... These get assigned to a token for which you can set the name (token_name in this example) Search Panels; $token_name$ | stats count by blah $token_name$ | chart count over blah by blah And so on.. ... View more

This question is pretty open ended. There could be thousands of ways to achieve these in Splunk. Have you sought out professional services to assist in your deployment? I'd say start with the Windows Infrastructure app and go from there. Otherwise, your use case needs to be researched and planned thoroughly. ... View more

fillnull value=0 {{field_name}} | timechart.... ... View more

I also see you are using iplocation so you may only want to split by a single field. You can concatenate the fields you want using eval eval user_combined = Username." - ".UserAgent." - ".IPAddress | stats count by user_combined ... View more

Simply add those fields to your split-by clause so, stats count by Username, UserAgent, IPAddress. Then further down you can filter your search by user. Stats can theoretically split by an unlimited number of fields. ... View more

It's safe to assume it does. Forwarders as just scaled down versions of Splunk so the configurations are mostly universal. ... View more

If you're using a distributed environment. The app goes on the search head and the add on goes on the indexer. If standalone, both go on the same instance. ... View more

I would double check the permissions on the field extractions. The user you're running the scheduled search as which powers the alert much have read access to the extractions. ... View more

Try loading the values for the field you're comparing into a multi-valued list. Then you can compare the adjacent value without a join. stats list(conc) as conc by Menu_Id DESCRIPTION APPLICATION CO_CODE DATE conc1 | eval yes = if(match(mvjoin(conc, " "), "conc_day1_value (conc_day2_value){1,2}?"), "True", "False") | search yes=True What this does is reads the list and looks for the change in value you specify (in bold) between 1-2 times and tags the event with a field "yes" with a value "True" or "False". You'll probably need to change the fields here a bit but the logic should render what you're looking for. ... View more