Simply use the british locale. Instead of logging on to http://servername:8000/en-US/account/login log on to http://servername:8000/en-GB/account/login and all times will be in 24 hour format. [edit: answer comment] The locale of splunk is determined by the browser locale, see http://www.splunk.com/base/Documentation/4.1.4/admin/Userlanguageandlocale for more information. Basically you have two options: Distribute a login URL to your users with the en-GB locale in the URL Change the user's browser locale to en-GB. ... View more

Out of the box an indexer cannot reach to a forwarder to pull data -- the system is designed for forwarders to push data to the indexer. I am running forwarders in my DMZs as well. Here is my setup, this might work for you as well: I determine the DMZ host that has the least amount of load, and set it up as a regular forwarder. This forwarder is configured to forward via SSL to my indexer as per http://www.splunk.com/base/Documentation/latest/Admin/EncryptandauthenticatedatawithSSL . Furthermore I configure the forwarder to check the receiver's certificate, and require the receiver (indexer) to check the client's (forwarder's) certificate so I can feel better about the correct data coming out of the DMZ. An appropriate firewall ALLOW rule is put in place to let the splunk data port through from that particular DMZ host to the indexer. Once this DMZ forwarder is working correctly with the indexer, I configure the DMZ forwarder as a receiver as well. Now I deploy lightweight forwarders on all other DMZ hosts, and have them forward to the first (regular) DMZ forwarder. The first (regular) forwarder pools all the data from the lightweight forwarders in the DMZ, cooks (parses) it, and then forwards it over the SSL tunnel to the indexer. For what it's worth, PCI auditors are fine with this setup. ... View more

The maximum amount of concurrent searches that can be run system-wide is determined by a setting in limits.conf: [search] max_searches_per_cpu = <int> * the maximum number of concurrent searches per CPU. The system-wide number of searches * is computed as max_searches_per_cpu x number_of_cpus + 2 * Defaults to 2 You can increase this value in order to raise your system-wide concurrent search quota. But since you are not hitting the limit as admin, you likely have to increase your regular user's concurrent search quota. In authorize.conf you will want to tweak srchJobsQuota = <number> * Maximum number of concurrently running historical searches a member of this role can have (excludes real-time searches, see rtSrchJobsQuota) and possibly rtSrchJobsQuota = <number> * Maximum number of concurrently running real-time searches a member of this role can have for the appropriate roles. ... View more

This issue is fixed in the very latest release, 4.1.4. Check out the release notes: http://www.splunk.com/base/Documentation/latest/ReleaseNotes/4.1.4#Unsorted_issues The issue you are encountering is Splunk Windows services (both splunkweb and splunkd) are installed by default with Startup Type set to "automatic", which means that if you have deployed light forwarders on Windows and haven't explicitly set Startup Type to "manual", the splunkweb process gets started every time you reboot your forwarders. (SPL-22434) New installations of 4.1.4 should not have this problem any longer. On your 4.1.3 servers you can disable the Splunkweb service with the following command run as a member of the Local Administrators group: sc config start=demand Splunkweb You can also do this remotely using sc \\servername config start=demand Splunkweb ... View more

You can file an enhancement request by submitting a Priority 4 - Enhancement Request ticket at http://www.splunk.com/index.php/submit_issue . ... View more

./splunk list saved-search lists the current user's saved searches. I don't think there is a command to show all saved searches. ... View more

In addition to attempting to pull data out of SCOM and using snare, there is another way to achieve your objective: use lightweight or regular forwarders. A forwarder installs on your servers and can access and forward all your event logs (and other data you choose to monitor) to your indexer(s). This may be easier (and likely more efficient) than attempting to integrate with SCOM's database. In addition you benefit from buffering and SSL tunnels, as well as resuming forwarding of data after a network outage -- all things that you cannot get with SNMP. Lightweight forwarders use only a small amount of resources and are easy to deploy. For more information have a look at this: http://www.splunk.com/base/Documentation/latest/Admin/Aboutforwardingandreceiving ... View more

You need to use OR logic in your query as such: sourcetype=access_combined (frkcurrent OR dmanager) Check out the this part of the documentation for a more in depth coverage of the search language. ... View more