What are your email settings? I suspect you do not have TLS enabled ... View more

Cheers! You should probably make that an answer so the OP can close the thread ... View more

I may have done the lookup incorrectly Make sure you are getting values for |metadata type=hosts index=<example index> | lookup dnslookup clienthost as host OUTPUT clientip | table host clientip If the clientip field is blank for all your hosts, have you tried resolving the hostname manually on your server? ... View more

I'm under the impression that the auth/login session token expires based on the session timeout settings (see http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Configureusertimeouts) I would also like to know if there's a way to generate a permanent token ... View more

Also the following search on a cluster member will tell you the captain | rest splunk_server=local /services/shcluster/captain/info | rename label as Captain | fields Captain ... View more

don't know about splunk on splunk, but you can view all the information in the Distributed Management Console ... View more

It shouldn't be an issue if you use stats instead of transaction , as you are no longer looking at the timestamp. As such it doesn't matter in what order the events appear in Splunk - stats will group them into the correct set based on the corId. If this doesn't quite make sense it may be because of assumptions I am making about your data - it might help if you describe or show how you want your final results to look (ie what fields you wish to display) ... View more

Are you actually getting a 404 in response? If you are it can be only one of two things The collector is not enabled You are making the request incorrectly Have you tried to access the rest enpoint from the splunk UI? You can do this like `|rest /services/collector/ack' If you get errors there the collector might not be properly configured. If you get no errors there then you may be making the request incorrectly - check the documentation of the tool you are using Just to clarify, you're not using http://10.0.0.148:8088/services/collector -H 'Authorization: Splunk 76805875-741A-40EA-920E-F7BB1EAA6CBE' -d '{"event":"Hello, World!"}' as a URL are you? ... View more

Any chance you can post some sample events? You may not need to use transaction at all ... View more

I don't know how your load balancer is configured, but I would guess it isn't handling the client session correctly. CRSF sounds like a session issue. Can you connect directly to a searchhead? Do you get the same problem? If you don't have any errors connecting directly to the search head then you have a problem between the lb and the search head. Could be a few different things but at least it will rule out problems with Splunk itself ... View more

Must be something AIX specific. Have you tried splunk support? ... View more

I see now. Yeah its going to be tricky as there is no way to define a zip code for each lat/long pair in your data. You could try bucketing but it wont be accurate, as each zip code is not a simple a radius. You're going to need a different lookup table that contains the entire lat long area for each zip code. You should be able to find some data online (Try http://www.opengeocode.org/download.php) ... View more

Oh - Are you starting the instances in seperate locations ? For example /opt/splunk-instance-1/bin/splunk and /opt/splunk-instance-2/bin/splunk ... View more

Sorry to hear that. Where is that message coming from? Splunk or AIX ? ... View more

Could be an issue with your postman plugin. Have you tried using curl? Also, is your collector running with SSL enabled? you will need to use https in your url if it is EDIT Also, the canonical documentation for the API is here: http://docs.splunk.com/Documentation/Splunk/6.3.1511/RESTREF/RESTinput#services.2Fcollector ... View more

I don't know if there are any AIX specific issues. On linux we just change management port and it works fine. ... View more

As the error says, your url is wrong. See http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/UsetheHTTPEventCollector Your url should be http://10.0.0.148:8088/services/collector/event ... View more

Hi Chris, what I mean is this. Your subsearch is search index=main auditSource=for-frontend auditType=FormSubmission | table Full_Details From what I can tell, Full_Details is a field that you created earlier in the search pipeline. The subsearch cannot actually access that field, so none of the events returned by your search will have any value for the field. So the result of the subsearch will be an empty set () Post the output from the job inspector as I suggested if this is not making sense and I'll be able to help further ... View more

Actually you did not mention that. All you said was that your events contain lat/long. You will need to be clearer about the event data. For example, do the lat/log fields in your events correspond directly to lat/long entries in your lookup table? Also, what do you mean by Population? Do the events contain population stats, or do you mean zip code when you say population. It will be easier to assist if you post A) Some sample events B) A sample table of results ... View more

Subsearches can be tricky things. It's worth checking what your subsearch results look like. You can see this in the remote search section of the job inspector. I suspect it is returning NOT (), which then becomes search NOT NOT () , which will not exclude any results for you. I recommend you have a read of the documentation on subsearch formatting: http://docs.splunk.com/Documentation/Splunk/6.3.1/Search/Changetheformatofsubsearchresults ... View more

Why did you swap the position of "auditType=FormSubmission" between the two queries? ... View more

ah sorry typo there in my search. Should be index=main auditSource=for-frontend auditType=FormSaved | eval epochevent=strptime(generatedAt, "%Y/%m/%d") | eval epoch1hago=relative_time(now(), "-1h@h" ) | table detail.referenceNumber epochevent epoch1hago But given you're getting no values epochevent my guess is that the generatedAt field is not actually UNIX time. Can you post some sample data? ... View more