Hi, Short explanation of my problem: I'm investigating a problem where two file downloads are apparently interrupted prematurely. For convenience's sake, let's assume I have two macros, file1 and file2 matching the downloads. I want a pie chart for both of them. `file1` |chart count by bytes `file2` |chart count by bytes For file1 I get a nice pie chart, where there are the counts for the two most common AND a slice with the label other(30) with the count 30. But for file2 I get a pie slice for each distinct value of bytes. (Hope this is not too unclear) Two questions: 1) Why is the behaviour for file1 the way it is? I didn't ask for it, but I do like it 2) How can I get the same behaviour for file2? My experiments with rangemap , bins and span puts all the results in ranges like 200000-300000, etc. Update: Since I didn't express myself clearly at first, I want to point out that I'm looking for a a way of setting useother to false from the search command itself. I have not included this search in a dashboard or view, so I there is no XML to edit. The reason for my question is simply that I sometimes need to a one-time search for this. This time, I was searching for failed downloads. But since the bytes field can also vary for succesful downloads, it is important for me to see all the count for all the values of bytes, not just the most common ones. ... View more

Hi, We have set up a Splunk infrastructure where all forwarders send their data to intermediary forwarders (universal forwarders), which in turn forward the data to the indexers. This is working out nicely, except for the Deployment monitor which does not present any information about the client forwarders, which use the intermediary forwarders. In other words, the indexers, search heads and intermediary forwarders are visible, as well as all the older forwarders who send their data directly to an indexer. Is there any way of getting ALL the information through the intermediary forwarders? ... View more

Hi, I'm about to implement search head pooling and probably also mounted knowledge bundles. I'm interested in what this will mean for the searches. Having read the documentation, I understand that the indexers will share a knowledge bundle, which is copied from one of the search heads, whereas the search heads will continue blissfully oblivious. What's confusing to me is that without mounted bundles, it seems the indexers constantly need to get an up-to-date version of the bundle(s) from each search head. Mounted bundles will disable this, correct? Will the indexers update the bundles they are sharing? Will upgrading splunk require me to copy the etc/system-directory again? Since the indexers don't need to keep the bundle in synch with the search heads, I'm not sure I understand the purpose of distributing them in the first place. Clarification: Having checked the documentation again, it seems that I don't have a clear understanding of how etc/system is used in the knowledge bundle. The documentation states clearly that the search heads will use their own etc/system. Doesn't that mean that replicating etc/system is somewhat redundant? ... View more

Hi, I'm trying to generate events through an external script from the search, using the script command. Splunk says the command does not exist in commands.conf. However, the documentation for the script command doesn't say that the script needs to exist in commands.conf. Is this just a simple omission, or am I doing something wrong? This is what I'm trying to do: | script perl foo ... View more