Hi, Since, I'm runnning into problems with concurrent historical searches approaching the limit, I decided to heed the advice of rescheduling them not to run on top of the hour every hour. Since there are a lot of those, I prefer to do it in the shell: cd etc/apps/webintelligence egrep '^(cron.*|\[.*\])$' default/savedsearches.conf | \ egrep -B 1 'cron_schedule = 0(\ \*){4}' | \ perl -pe 's/0((?:\ \*){4})/3$1\n/g' > local/savedsearches.conf What this does, is take every stanza with a cron_schedule of 0 * * * * and turn it into 3 * * * * , ie. running it 3 minutes after the hour. Unfortunately, Splunk doesn't recognise this change. (and I've tried |extract reload=T ). If I click on each saved search, it will show the correct schedule, but under the "Searches and reports", it is still scheduled to run at 15:00, rather than 15:03. So can I reload this configuration without restarting Splunk? ... View more

Hi, We are using the deployment server to distribute configuration to universal forwarders. Since we are using chef to install the forwarders, it would be very good if we could add the forwarder to a serverclass from the forwarder host itself, rather than doing this at the deployment server. Any suggestions on doing this. Preferrably, it should be scriptable. With that I mean either a CLI command to run on the forwarder, or some way to do it through the REST API. ... View more

Hi, I understand that Splunk 4.3.3 should support nested groups in Active Directory, according to this document. However, I'm unable to get it working. I have set nestedGroups=1 . I've also set groupMemberAttribute=member , (and tried without it as well), but it still won't work. Currently, I'm only testing this with one nested group. CN=it-infrastructure,OU=SPLUNK,OU=Application Groups,OU=Groups,DC=company,DC=domain,DC=tld which has a member: CN=infrastructure-internal,OU=Organisational Groups,OU=Managed Groups,OU=Groups,DC=company,DC=domain,DC=tld # authentication.conf: [AD] SSLEnabled = 0 anonymous_referrals = 1 bindDN = cn=svc-splunk-01,ou=Splunk,ou=Service Accounts,ou=Other Accounts,dc=company,dc=domain,dc=tld bindDNpassword = snafu charset = utf8 dynamicMemberAttribute = member groupBaseDN = ou=SPLUNK,ou=Application Groups,ou=Groups,dc=company,dc=domain,dc=tld groupBaseFilter = (objectclass=*) groupMappingAttribute = dn groupMemberAttribute = member groupNameAttribute = cn host = ldap.company.domain.tld nestedGroups = 1 network_timeout = 20 port = 389 realNameAttribute = cn sizelimit = 1000 timelimit = 15 userBaseDN = ou=Departments,dc=company,dc=domain,dc=tld userBaseFilter = (objectclass=*) userNameAttribute = samaccountname Now looking at the configuration, I'm wondering if the problem may be the groupBaseDN setting. This matches the parent group, but not the nested group. Is this the problem? If I widen it to just ou=Groups,dc=... , I get 1000+ groups, which is quite a lot, but I'm not sure if it's a problem. So, does the nested group also have to match the groupBaseDN? ... View more

Hi, Is there a recommended way of giving the Splunk TA sufficient privileges to read /var/log? Let me elaborate: simply doing a chmod -R a+r /var/log may be a little too slapdash on security. Besides, some software may actually reset permissions to its own default. Simply adding the splunk user to the root group may not be quite the desired results either. If someone has solved this for RHEL, I'd be grateful for any input. ... View more