The release notes for 4.3.4 are here. They suggest that you're seeing bug SPL-52862. If you're unable to upgrade at this time, you can work around the issue by using | fields <fields_you_want> at the end of your subsearch. The list of fields should be those which are referenced by the calling (outer) search. ... View more

You may find that a transform called syslog-host or syslog-host-null is being applied to events arriving on UDP/514. This transform remaps the host field based upon the contents of a syslog-type line, which contains the hostname in the event itself. You can check the connection_host attribute in inputs.conf to specify that the source IP should be kept as the host value. You'll also want to make sure that the syslog hostname transforms listed above aren't being applied to your sourcetype. ... View more

I'm not sure that Splunk parsed the date OK; it looks like it might have been given "NOW" time when the event arrived at the indexer. I second the notion of swapping %m for %e. Also, consider checking the logs (splunkd.log in this case) for DateTimeParserVerbose events. ... View more

Note also that maxDataSize is just the upper limit for a bucket's size. Other factors (such as restarting Splunk, time-based rotation, etc) may mean that a bucket is actually smaller than this size. The product of maxWarmDBCount and maxDataSize then represents an upper bound on the warm space in use. ... View more

Unfortunately, it seems we don't. There's the 'typeahead' search function, but it's currently only wired up to the search bar in the "flashtimeline" view. At the moment, it seems it's not easy to do what you've asked. ... View more

Check your time range? If you're indexing historical data, the time range might not include those events. Does the index exist? Splunk won't create it for you, based on inputs.conf alone; you have to create the index first. ... View more

The dashboard can still contain two panels; it doesn't have to be emailed. Consider the main landing page of the search app--there are several different panels. The searches that drive a given panel don't have to be related. Each of your above searches could easily be given its own panel, viewable on demand (vs. scheduled). ... View more

Adding the index on the web interface adds it to the search head's local filesystem. It doesn't add it on the indexers themselves. In a lot of cases, the web interface of the indexers is turned off, to save memory as it commonly isn't used in this kind of distributed environment. I'd suggest first going to the indexers (command line is OK) and issuing splunk list indexes to see if your indexers have this new one. You could then add them directly to the indexes.conf, or temporarily spin up the Splunk UI on the indexers to be able to use the UI to add the index. ... View more

Have you configured it to use a port < 1024? If you've changed the configuration to be on the standard HTTP (80) or HTTPS (443) port, you'll need super-user privileges to start. Consider also checking the web_service.log or splunkd.log in $SPLUNK_HOME/var/log/splunk directory. ... View more

Note that for the summary indexed data to be visible to the other search heads, you'll have to set up server 8 to send its data back to the indexers. This means that it has an outputs.conf just like the forwarder system, listing all five indexers. Furthermore, you'll need some additional data in outputs.conf to direct Splunk (on server8) to index nothing locally: [tcpout] forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = forwardedindex.2.whitelist = [indexAndForward] index = false While the entries missing a right hand side (nothing to the right of the equals sign 😃 may be confusing, those are used to clear a default setting, by emptying the setting. ... View more

At present we are using Flash charts for most of it, but unfortunately, upgrading is off the table at this time. I'll dig further with the info you've provided so far. ... View more

If Splunk is indexing in UTC, then your server is likely set to use UTC. See this link for help on how Splunk sets time zones: http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/ApplyTimezoneOffsetsToTimeStamps ... View more

Note that you could probably safely remove the deploymentclient.conf if you don't want any of this functionality. The installer (on Windows) creates this file from scratch with data you provide during the install wizard. ... View more

Have a look at this (admittedly older) response to this kind of question: http://splunk-base.splunk.com/answers/2381/form-input-suggestions-google-suggest To the best of my knowledge, there isn't yet a better way of achieving what you've requested. ... View more

outputs.conf changes require a restart of Splunkd. If your serverclass.conf doesn't specify restartSplunkd = true for deploying that app, that's one possible cause. Is it possible that the forwarders believe that they have the latest version of the application, so even if you changed the serverclass.conf to add restartSplunkd = true to the definition, and issued splunk reload deploy-server the clients wouldn't receive the restart instruction, because the app is still up to date. You can jiggle its elbow a bit by making a small cosmetic change to the configs in that app (an extra comment line would be enough), and then push out the new app again. While not a solution, this search may help: index=_internal (sourcetype=splunkd PackageDownloadRestHandler) OR (sourcetype=splunkd DeployedApplication Downloaded) | rex "streams/deployment\?name=(?<ds_stream>.+?):(?<ds_class>.+?):(?<ds_app>.+?)\s" | rex "ServerClass:\s(?<ds_class>.+?),\sapp\s(?<ds_app>.+?)\s" | transaction startswith="PackageDownloadRestHandler" endswith="DeployedApplication" ds_class, ds_app ... View more

Your initial regex featured a caret (^) in the initial position meaning "start at the beginning of the string" in regex-ese. Since the paths begin with D:\, your regex wasn't going to match. Glad to see you've got it working. ... View more

If you don't need to (re-)generate the table based upon search results, then just go with inputlookup. ... View more

If your post processing search results in an empty set (e.g., from your example, there are no values with Fixture > 0), FlashChart will just display a blank graph, instead of the slightly more user-friendly "No results found." If several of your panels depend upon the search condition "Fixture > 0", you might want to group those together within a HiddenSearch, and PostProcess after those. The other panels on the page would need their own search / post process. ... View more

This document suggests that the "sourcetype::" is in fact needed. ... View more

When you say "the latest time of the search is 31.08.2011", do you mean that this is a saved search (or summary indexing search) and the "most recent" run was 31.08.2011? ... View more