Hi All, Is there any equivalent variable for this in Splunk 6.4.0? $search.timeRange.label$ I have used the above variable to display the selected time label, but I'm looking for any equivalent with the new Splunk version we are using. of course i have come across to use to earliest and latest separately in 6.4.0, but couldn't actually get the label name displayed. i.e able to get something like this: selected Time is **-7d@d and now** in SPLUNK 6.4.0 whereas earlier in SPLUNK 4.3.2, I used to get: selected Time **Last 7 days** How can we get this back again? Many thanks, Rakesh. ... View more

Hi All, I am using SPLUNK 6.1.2 and I am using the following in my App navigation page, <a target="_blank" href="www.google.com"> Search Google </a> But its not working as expected! Any help? Thanks, Rakesh. ... View more

Hi Team. I am using SPLUNK version 6.2.6 and when I run my search in search app, I could see it's executing for a while and then it pops up a "Finalizing job... " message and not finalizing the search results. Is it a bug in SPLUNK 6.2.6? I am not able view any search results because of this. Please find the screen shot for the same. ... View more

Hi All, I have a summary index called "my_index", which has the data every 30 min from a saved search. I want this data to be in the index for the span of 30 min from the time of data is loaded in the index. For this, I have used the below settings, but it seems it's not working... Am I missing anything? [my_index] coldPath = $SPLUNK_DB/my_index/colddb homePath = $SPLUNK_DB/my_index/db thawedPath = $SPLUNK_DB/cold/my_index/thaweddb maxHotSpanSecs =1800 frozenTimePeriodInSecs = 1800 rotatePeriodInSecs = 60 repFactor = auto Can someone pls help me with the configuration for the setting I require? Many Thanks in advance. ... View more

Hi All, I have 4 Indexer Servers, 2 per each Site. Site1 has 2 and Site2 has 2 servers in each. All these 4 servers are in clustering and I have a Master Node to monitor these 4 Indexer peers. Site based clustering is implemented so in any case if any site is down, I can still be able to get the data from the other site. Now my problem here, I have an index called "my_index", and I need to clean this index on a regular basis without impacting the business. So I have written a script to each one indexer by other and clean the eventdata of "my_index" and restarted them. By doing so, once the indexer is restarted again, it's getting "my_index" data back, since the replication factor is given as 4 and its getting the data again. I cannot afford to stop all the 4 indexers at once and clean the eventdata as this will impact the customer till the indexers are up and running. Can you please suggest if there is any SMART WAY of cleaning the indexes on a regular basis without impacting customers? Thanks, Rakesh. ... View more

Hi Team, I have a forwarder installed and configured to forward logs that it is receiving daily. The timestamp in these logs are different and it is configured as timestamp. Now my requirement is to get the data from all the files that are indexed today. How can I get these results in a search? Below are the list of files I indexed on Dec 20th. -rw-r--r-- 1 gaiext ab 25457 Dec 20 00:06 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220000622.dat.gz -rw-r--r-- 1 gaiext ab 12448 Dec 20 02:03 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220020355.dat.gz -rw-r--r-- 1 gaiext ab 5432 Dec 20 04:04 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220040418.dat.gz -rw-r--r-- 1 gaiext ab 3076 Dec 20 06:04 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220060408.dat.gz -rw-r--r-- 1 gaiext ab 2155 Dec 20 08:04 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220080407.dat.gz -rw-r--r-- 1 gaiext ab 3249 Dec 20 10:04 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220100421.dat.gz -rw-r--r-- 1 gaiext ab 7943 Dec 20 12:06 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220120628.dat.gz -rw-r--r-- 1 gaiext ab 17644 Dec 20 14:06 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220140652.dat.gz -rw-r--r-- 1 gaiext ab 24234 Dec 20 16:06 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220160607.dat.gz -rw-r--r-- 1 gaiext ab 23714 Dec 20 18:04 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220180453.dat.gz -rw-r--r-- 1 gaiext ab 23330 Dec 20 20:05 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220200525.dat.gz -rw-r--r-- 1 gaiext ab 23653 Dec 20 22:05 BPP_WL3-XXXX_PUR-PUMAIN_v4_DNH_1_1_20151220220519.dat.g How do I search to get all the files on a daily basis. If I log in to the search head on the 21st, I need to get all the files that are indexed on the 21st. index="myindex" | where _indextime=now() I tried the above, but didn't work? Is there any better approach? please help ... View more