I assume you mean you mean "date" and not "data". You can populate a summary index with historic data by following the backfill procedures described in the documentation at http://www.splunk.com/base/Documentation/4.1.5/Knowledge/Managesummaryindexgapsandoverlaps#Use_the_backfill_script_to_add_other_data_or_fill_summary_index_gaps ... View more

The behavior you describe is the flashchart module's default behavior, no special params need to be configured for this behavior. [edit:] In regards to your clarification: Hovering over a single field in a column on a stacked column chart should fade out all other columns and all other fields in the current column. The same behavior should be exhibited by the bar chart. ... View more

The easiest way to control which fields get passed to an alert email is with the table command instead of fields . process="sudo" incorrect | rex "(?i)^(?:[^:]*:){3}\s+(?P\w+)\s+:" | table uid, host, COMMAND But you could also do using fields process="sudo" incorrect | rex "(?i)^(?:[^:]*:){3}\s+(?P\w+)\s+:" | fields - _* | fields uid, host, COMMAND ... View more

Take a look at the AlertThrottle app on Splunkbase, with it you will be able to throttle repeat alerts. ... View more

Take a look at the loadjob command. You can load the results set of a previously executed job if you know either the job's ID or the name of the saved search run. This should work just fine from the CLI. ... View more

Based on your comment, auditing is what you are looking for. Fschange will not be able to help you, as it does not log the username that performed an action on a file on Windows -- it only work correctly on Unix. On windows you will want to define NTFS SACLs (Security Access Control Lists). These are the auditing entries you may be familiar with in NTFS. You will have to enable object access auditing in the local security policies of your servers (this can easily be done via group policy). Then you can enable auditing on a set of files or directories. This can be done manually, but if you have a standard set of auditing rules you may consider pushing them out via group policy as well. Here is a link that goes over these basics: http://articles.techrepublic.com.com/5100-10878_11-5034308.html Once you have selected the types of accesses you want to audit (Read,Write, Create, Append, Delete, etc) you will start seeing events 560, 561, 562, 563, 564 and 567 logged. Check out http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx for more info on them. But basically you will see a 567 object access attempt logged first, then you can do a transaction based on the handle id to see what else was done to the object. ... View more

As long as you don't stick the IIS sites on the splunk ports (8000, 8089, 9997, etc) you will be fine. ... View more