hi harish_ka can you try this commad xmlkv commad i think this may help thanks ... View more

hi manuman for more infos on this path i will like you to check it the documentation on the topic About migrating Splunk Light in the documentation http://docs.splunk.com/Documentation/SplunkLight/latest/Installation/Aboutlicensing i know we can not migrate from splunk enterprise free to splunk light but we can migrate from splunk light to splunk enterpise yes the liense is the only thing change because in Splunk Light licenses control the indexing volume and feature set of the Splunk Light product not for splunk free server you need to reconfigure but in your app ... View more

hi sreejikit2k2, for the moment there no documentation on this planing resources . the only documentation we have for now is the capacity planning manual which is not interested on what you need i havelook every where on the internet i have not see some thing that can be interest on what you need thanks ... View more

hi sreejikt2k2 what exactly are you doing i am waiting for reply if you are using deployment i am waiting for reply ... View more

hi hi srejith2k2 i think this documentation may help waiting to hear from you if this document can not help http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Aboutdeploymentserver ... View more

hi srejith2k2 i think Large enterprise can help A large enterprise deployment handles functions across the enterprise, spanning multiple data centers. These deployments might consist of: -A large number of Splunk instances; for example, several dozen indexers and as many as 10 search heads. -Indexing volume ranging from 300GB to many TBs per day. -Many thousands of forwarders. -Updates handled by a separate configuration management tool, either a stand-alone deployment server or a third party tool like Puppet or Chef. -A large number of users, potentially numbering in the several hundreds. ... View more

hi j666gak it look as if you are having a problem on setup Splunk App for Windows Infrastructure: i forward you a documentation i think this wll help so your problem waiting to hear from you http://docs.splunk.com/Documentation/MSApp/1.0.2 ... View more

hi sapact i have something for you i think it may help you i have a documentation that i want you to read i belief this may help you read on Get Window Data it will help you solve your problem http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Usingapps thanks ... View more

hi federica i have something for i belief i you following this proceduce it can be possible you can be the grand administator on your machine in which you can access the text file as you wanted but i will give but a link to help on the following steps but it is in french i believe you can use a translation google to understand it this the link http://www.chantal11.com/2010/01/activer-compte-grand-administrateur-windows-7-edition-familiale/ i am waiting to hear you reply thanks ... View more

hi federica please federica what exactly are you doing what program are using i know what you give me above is use in C Programming ,if that is what you want to do, using splunk know that it is not possible thanks ... View more

Hi kenji actually the first problem is that you are having problem with your search request you need to add .csv this is the right search request 36 | inputlookup SPSite.csv 37 | table Id,Url 38 | rename Id as SiteId 39 | join type=outer [ search eventtype=mssharepoint-audit Event<14 | stats count by SiteId ] 40 | where isnull(count) 41 | table SiteId,Url secondly another problem that you said that you not can see the SPSite csv because you have not define the right directory this is the right want $SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps/*/lookups ... View more

hi federica i now understand you very well it mean that you want to write on text file meaning why you are on splunk framework this are the steps 1-go to destination on which the text file is right click on the text file 2-a dialog box will open go to properties click on it 3-a new dialog box will open click on security on the menu above -on security on the name of the group of the user choice the name of your machine that you are working with -if you do not have an autorisation on the text file i advise you to click on modify button below after the first layout 4- another new dialog box will open then you chose the name of you of your machine again - on the administration autorisation on the give permission if the check box under it are uncheck please i advise you to check all the check box that are give under permission after doing that 5 click ok and go to the text file that you want to write on it and open and write it and save it that is all i am waiting to hear from you it work thanks ... View more

hi federica yes this is possible what you have to do is to copy the txt file to desktop and from there you can open it and on write it and after that you can carry the txt file to the destination were you copy it thanks ... View more

hi xvx006, for more information on how to install the mac i will like you to check on the documentation Splunk-6.1.1-Installation i think this may help you on how to do it thanks ... View more

hi riough please i will like to remove the top commad from your search query, why do i say so is that if you look carefully it return the percent and count of useid in which if the userid have so many values it take alot of time to return the search query. so what i advice you to do is to use the sort Command instead of top why do i say so is because the sort command sorts the results by the given list of fields. Results missing a given field are treated as having the smallest or largest possible value of that field if the order is descending or ascending, respectively. you may do something like this for more information on this sort commad i will like you to check on the documentation Splunk-6.1.1-SearchReference thanks ............|sort 100 userid ... View more

Hi kenji it seems as if you are having a problem with your token that you just define in the /opt/splunk/etc/apps/Splunk_for_Sharepoint/default/data/ui/views/usage_sites.xml' what i will like you to do is to check the token that you just define in usage_sites.xml because look the message carefully it say that Checking configuration... Error while parsing '/opt/splunk/etc/apps/Splunk_for_Sharepoint/default/data/ui/views/usage_sites.xml': not well-formed (invalid token): line 39, column 62 let take a look at the last message there was problems with the configuration file so please check the token at the usage_sites.xml' in the file that is the problem There were problems with the configuration files. Would you like to ignore these errors? [y/n]: please try to check the token that you define if you can not do it very well please paste the code on answer i think i may help you to resolve this problem thanks ... View more

Hi hattrickN, i have two alternative ideals i will like you to check on maximum number of concurrent realtime searches has been reached as you just said above or change the browers that you are using it may be the problem of the browsers for more information on the type of browsers to use in splunk i will like you to check on the documentation Splunk-6.1.1-Installation on Supported browsers that you need this may either be the solution to your problem. for the xml code is okay. thanks ... View more

Hi hattrickN, i have use the search request that you gave me about with my own personal data from my machine it is working .This the request that i use it is working very well with personal data from my machine .............| timechart span=h max(date_hour) count by sourcetype Are you sure that you are have a problem with your Xml code i will like you to paste the xml code on answser so that i help you verify on the xml code . Another alternative ideal maybe is the browser that you are using can not be support by splunk this may cause problem like that thanks ... View more

I have never come and cross such a thing like that i know that all selector modes are use to return a search which return the fields and events depending on the selector mode chooses and from there you can save it as dashboard panal base on the events and fields return by the selector mode use. or do you want to Set search mode to adjust your search experience if so i can help you read on Splunk-6.1.1-Search this will help you faster to know what this mode are use for. i have never see a dashboard been save as panal is been display by a selector mode . Note that every search that is been make by using the selector modes will return the number of events and fields depend on the mode selected and which it is save as dashboard panal depending on the number of fields and events the selected modes return . Note That the dashboard you save as panal it will display fields and events at the process in which it is save as dashboard panal not in the selector mode again The only way I can help you for at this moment I will like you to check the hardware material of the machine that you are using because most problem that I have come and pass through went I want to verify on the material of the hardware machine it is not what splunk has Recommended due to this it cause dashboard not render quickly . I will like you to check on the Recommended and minimum hardware capacity in the documentation Splunk-6.1.1-Installation if the problem can be material of hardware Another problem maybe the search request that you have make, you know that there are search request that are more consisting or heavy than the search head ,so during the time that you want to display the dashboard it can take a lot time to display it due to the search request that is more consisting or heavy this is what I can help you at this moment th anks ... View more

hi fecikertmd; Are sure of what you are saying i have created a lookup table file and defintion i can see the option delete on this UI both of them can you try it again but i will like to give you a reference that is what i try to use and i was able to see the option delete on UI on both of them in which i can delete . please can you check on reference on the documentation Splunk-6.1.1-SearchTutorial i think this may help you . You will see how to do this lookup table file and the definition lookup very well on page 51 Splunk-6.1.1-SearchTutorial. thanks ... View more

<chart> <title>Pan and Zoom (All source types)</title> <searchString> index=_internal | timechart count by sourcetype </searchString> <earliestTime>-7d@h</earliestTime> <latestTime>now</latestTime> . . . <selection> <set token="selection.earliest">$start$</set> <set token="selection.latest">$end$</set> <set token="start.splunk_web_access">$start.splunk_web_access$</set> <set token="end.splunk_web_access">$end.splunk_web_access$</set> </selection> <chart> <title>Pan and Zoom (Web access source type)</title> <searchString> index=_internal sourcetype=splunk_web_access | timechart count by sourcetype </searchString> <earliestTime>$selection.earliest$</earliestTime> <latestTime>$selection.latest$</latestTime> . . . </chart> i think this example can help u try to use this code thanks and manage with your request ... View more

hi yes this is possible just deload app splunk-6x-dashboard-examples_201 there is an example that is called Time Range Picker Within Panels that show indivdual time range pick on dasboard i think it may you thank's ... View more

hi royimad yes there is exist a charting options can you check on Splunk-6.1.1-Viz page 237 or can you check on the application simple_xml_example there is an example i think this may help you thanks ... View more

pl can u send me the code through this mail juvet45@yahoo.com i can help you this problem ... View more