it was already set in the ps.sh script, which is how I stumbled across it. I tried to copy/paste the CMD from ps.sh and got that same error. ... View more

Though I've not updated to the TA for my *nix inputs yet, will roll that into my 6.0 upgrade. ... View more

Excellent - this is what I needed. I created a copy of the SA_nix app's indexes.conf file in the local/ directory, complete with custom volume information for indexers. Everything seems to be working now when being pushed out with the deployment server. Appreciate the help! ... View more

Thanks, your answer matches what I've slowly been learning! Have a great weekend. Al ... View more

what add-on you are referring to ? i am also getting same error for deployment server after upgrading from 5.x to 6.x version. ... View more

In ~/etc/system/local/ui-prefs.conf on your search head, set the following which will set "Last 15 minutes" as your default search time range in the picker: [default] dispatch.earliest_time = -15m dispatch.latest_time = now ... View more

The only comment I'll make here is that if you rsync a bucket in its hot state (a directory name like hot_v1_15) and then later rsync again, but this time the bucket has been moved to warm (a name like db_1381409248_1381408249_15), Splunk will refuse to start because of the collision between the bucket IDs (the _15 at the end). After your first rsync, but before your cutover, remove any hot buckets from the target system. ... View more

Definitely a browser issue. I tried last night with the exact same path. Macbook Air -> VMWare View Client -> Windows7 & Chrome. No issues this time. No worries Alex, with so many around and I hadn't seen you since at least Feb. at the office. ... View more

Lucas K is correct, you can edit the file from the CLI, using your favorite CSV editor, or have a saved search update the values. A few important things to consider: make sure you retain the column order: host, unix_category, unix_group make sure you delete the default entry of "*,all_hosts,default" before you add any other entries ... View more

Found the documentation here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval#General ... View more

Hi Mike, If you review the python lookup script you can see that there is some code commented out. If you remove the # the lookup script will create this file and log what it recieves from your splunk search and what values are given back. This is how i track during development how the script is working, how many lookups are performed etc. As it can produce a lot of data dependinc how many realtime lookups of ip's you are doing i did not emable it by default to aboid eating up any splunk license. I might have should removed the input before doing the release. Thanks for the hit. I'll consider this for a next update. Also make sure you add IP Reputation as tag to your answer. This is how you question gets notized from me immiditly. Happy splunking, Matthias ... View more

much cleaner than the other method I was using. Thanks! ... View more

It's available as lxorg-x11-server-Xvfb-1.13.0-11.el6.x86_64.rpml Hopefully that link will work with your login. ... View more

Thanks Mike, I used your suggestion (via a slightly different approach. I used a join with | streamstats count as item_id). The revised table now has an item_id representing a numeric y-value. There is still one problem. My search looks like this: ... | chart values(item_id) over _time by Product While a 'line' Chart type plots reasonably, a 'scatter' does not. Is there anything peculiar with my data or search that breaks a scatter ? Thanks again, Tom ... View more

See http://wiki.splunk.com/Community:WindowsCharacterEncoding, which provides a solution for - Logs coming in as hex - Logs not monitored with the messages: "TailReader - Ignoring file '' due to: binary" and "FileClassifierManager - The file '' is invalid. Reason: binary" ... View more

Hmm, only pulling the first line. REPEAT_MATCH = true is set, but no affect. ... View more

in that case put this in your props.conf and you'll be good to go. [iis-2] rename=iis ... View more

If you are using SSL, "compressed = true" will have no effect either in inputs.conf or outputs.conf. We are going to amend the spec files for those two configuration files to make that clear. ... View more

A few years ago I spent about a week with a customer trying different schedulers on a Debian machine. It turned out that there was no clear advantage to any of them from a search or indexing performance perspective. From a tuning perspective, I haven't seen too many optimizations that make a big difference with search or indexing. On certain platforms such as Solaris, specifying certain mallocs other than the system default can yield better performance in some cases. When testing indexing or search performance, the same customer mentioned above did show me a useful one-liner for making sure that the OS caches don't muddy your results. Use caution and only run as root: echo 3 > /proc/sys/vm/drop_caches ... View more

Rakesh, we've asked our partner sales team to help you out, please respond to the email you've received to let them know how they can assist you. ... View more

multikv is just responsible for taking a table set of results, and splitting them into individual lines and field extracting. Without the multikv, it will return the full df output. With it, just the single line. ... View more

Correlating the time these messages occurred, there was an issue on the Exchange host, and the admins were moving these files off as the filesystem was filling up quickly. Asked on Splunk, when I should've asked the Exchange admins first. ... View more

I bet you're probably correct there. Just need to verify. Thanks. ... View more

Thanks for the bug report. I've filed a bug against this one and it will be incorporated in the next release of the app. ... View more