Hi, I've sat up a Splunk Cloud Trial environment and have started to invite some test users. When I invited the first user he logged onto my Splunk Cloud with his normal Splunk Customer Community user, no problem. A day later or so I invited several other users, but all of them get an 404 error when trying to log onto my Splunk Cloud. All users are following the link from my invitation. Beside myself, the user I invited first still have access to the Splunk Cloud. Is there a limit on concurrent users for Splunk Cloud Trial? I tried to delete all users, and then invite a single new user to the cloud. Again he got an 404 error. Could it be that there is a limit to the number of invitations I can send from my Splunk Cloud Trial customer portal? Any help is much appreciated! ... View more

Hi, With Splunk Enterprise it's possible to secure Splunk Web with your own certificate by copying your server certificate to /auth/splunkweb and doing some configuration in system/local/web.conf . With Splunk Cloud, I don't have access to the CLI and therefore cannot secure Splunk Web with a certificate in this way. Is there any way around this? Or do I have to send a support ticket as a change request to Splunk to get this done? Thanks! ... View more

Hi, I've started testing out Splunk Cloud for a customer by setting up a Splunk Cloud Free Trial on my personal Splunk account. I know that I can invite users using the portal on Splunk Customer Community, but can I edit user settings using the Splunk GUI/UI? The documentation clearly says one can do so: "If you do not log into Splunk Cloud through the Splunk Customer Portal, access the Users page of your Splunk Cloud user interface to manage user accounts. If you have administrator rights, you can create, edit, clone, and delete users." Though, when I enter Splunk Cloud GUI and go to Access controls I only see Roles, not Users and Authentication method, as is usual in normal Splunk Enterprise. I know that I have admin rights, at least according to the portal on Splunk Customer Community. Also, I know that the documentation says that I should "not log into Splunk Cloud through the Splunk Customer Portal", but if I try to invite a user to my Splunk Cloud that is not a Splunk Customer Community user, that users is "forced" to sign up to (or create a new user on) Splunk Customer Community before continuing. Is the documentation outdated, or am I not allowed to manage users on Splunk Cloud because I use a Free Trial? Any help will be much appreciated! Thanks. ... View more

Hi, I've encountered this problem a couple of times now. I have a dashboard where some of the panels run on a base search to save computing power. When I open the dashboard the panels using the base search are showing zero results, but if I open them in search I get the results I want. I'll provide the XML. Why could it be that this is happening? Is there some sort of missing capability that prevents me from seeing the results in the dashboard or app even though I can see the correct results when the panel is opened in search? <search id="manageStoreEmployee"> <query>eventtype=a OR eventtype=b</query> <earliest>$token_time_picker.earliest$</earliest> <latest>$token_time_picker.latest$</latest> </search> <panel> <title>Manage Store Employee - Front-End</title> <single> <search base="manageStoreEmployee"> <query>| stats count(eval(status!=422)) as success</query> </search> </single> </panel> <panel> <title>Manage Store Employee - Back-End</title> <single> <search base="manageStoreEmployee"> <query>| stats count(eval(status!=502)) as success</query> </search> </single> </panel> ... View more

Hi, I'm trying to figure out how the whitelist and blacklist in outputs.conf work. By default it looks like this: [tcpout] forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = (_audit|_internal) It is stated in the doc that blacklist overrides whitelist. Doesn't this mean that rule #1 overrides rule #2? Doesn't rule #1 state that all files starting with an underscore is blacklisted? Still rule #2 states that _audit and _internal are whitelisted. As far as I know, internal and audit are forwarded by default. Can someone help me understand this? ... View more

Hi folks! I've made a search that returns all hosts that sends events of some kind to indexer, but does not send internal metrics events. index=_internal source=*metrics.log | dedup host | append [| metadata type="hosts"] | stats count by host | search count=1 | lookup dnsLookup host OUTPUT ip | fields host, ip The search first finds all hosts that sends metrics data, and then finds (append) all hosts that sends data at all with the metadata command. Every host that sends metrics data should show up two times, while the hosts that doesn't will only show up in the appended metadata search. Thus, if we count them, all hosts that only show up one time (count=1) does not send metrics data to my indexer. My question is then; why do I have several forwarders/hosts showing up in this search? Given that my search is reasonable, is there any way to "activate" the logging of metrics data on these hosts? ... View more

Hi, I've started looking into Splunk Cloud for some customers. At the official Splunk website it says that the Splunk Cloud subscription includes storage for 90 days, but that additional storage is available. Though, at the official Splunk doc pages, it says that "you can modify the default [retention] setting of 1,825 days (5 years) with a value from 0 to 36,500." I somehow doubt that I can set my retention time to 100 years without any extra cost. So which one is it, 90 days or 5 years? I'll provide the links. http://www.splunk.com/en_us/products/pricing.html#tabs/cloud http://docs.splunk.com/Documentation/SplunkCloud/latest/User/Manageindexes Also, if the retention time is indeed 90 days, how do I extend that time and what is the cost of doing so? Thanks! Regards, Martin ... View more

Hi, We're trying to create an interactive dashboard with gauges that dynamically change the range values depending on duration of the search in hours. We've used 10 as an upper limit for the green zone for a duration of one hour, which means that for e.g. 24 hours we want the upper limit for the green zone to be 240. The example search below shows how we imagine this could work, using the fictional hour(_time) command to count the hours of the duration of our search. index=index1 eventtype=$field2$ status=404 | stats count as errorcount | stats count hour(_time) as hours | gauge errorcount 0 10*hours 20*hours Obviously the search above doesn't work. Do any of you guys have a solution for this? Thanks! Regards, M&J ... View more