It might not be there already but you should be able to add it there anyway. Sorry, there isnt a nicer way of doing it 😞 Cheers ... View more

Can you post the code that you're using to submit the API request? You should be fine if you start the query with | (no space before it). ... View more

Yes that is true - You'd be as well to add the static entry. but...now you know about makeresults ! ... View more

Are you able to upload a picture so I can see what it looks like? Thanks ... View more

Here is a simpler example of how this might work: index=* | timechart count by source | append [search index=* | timechart count by sourcetype] For your search this might work: index=nix sourcetype=cpu host="host a" CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host | append [search index=nix source=vmstat sourcetype=vmstat tag=memory host="host a" | timechart limit=0 max(memUsedPct) by host] ... View more

It isnt really ideal - but you can edit the following file: $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/css/bootstrap-enterprise.css Have a play around changing the CSS for .wrapper-container and .account . I added the following which top-right-aligned the login page. .account { top: 0; } .wrapper-container { float:right; } ... View more

And then restart splunk 🙂 ... View more

You can use the following command: $SPLUNK_HOME/bin/splunk set web-port 8080 (Where 8080 is your new port). Alternatively you can edit the web.conf (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf) Put the following in $SPLUNK_HOME/etc/system/local/web.conf (create if doesnt exist) [settings] httpport = 8080 ... View more

Whoops - Should have read more carefully! Sorry but that is a bit trickier. Its not possible to do a traditional lookup. You're best bet would probably be a time-based lookup so your lookup at searchtime is accurate to the time the data was indexed...it depends on your specific case. Sorry I couldnt help further! ... View more

Hi, by specifying OUTPUT as part of your lookup command, it will overwrite fields in your results with the value from the lookup if the fields match. e.g: sourcetype=access_* | stats count by status | lookup status_desc status OUTPUT description In this example, any previous description field will be overwritten. However, if the field in your event is called myDescription then you would use: sourcetype=access_* | stats count by status | lookup status_desc status OUTPUT description AS myDescription I hope this helps. ... View more

Hi, Do you have a unique ID for each job that runs? If so - try something like this: index=yourIndex [search index=yourIndex status="STARTED" | fields yourUniqueIDField] | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS" This should give you data for everything that has Started, but where there is not a FAILURE or SUCCESS log line. You might actually find you dont need the subsearch, the following might also work: index=yourIndex status=* | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS" I hope this helps! ... View more

Hi, Are you planning to continue indexing to both indexers once your remove indexer clustering, or just one at once? Dont forget that you'll end up using twice your license amount if you index it on multiple indexers that arent in a cluster. ... View more

Hi, In 5.0.5 and 6.0, as part of a security-related fix (reference SPL-65987) Splunk disabled the ability to insecurely embed content on a remote site by default. To restore this capability, you now need to make an explicit change in web.conf to the x_frame_options_sameorigin parameter and set it to False: x_frame_options_sameorigin = [True | False] * adds a X-Frame-Options header set to "SAMEORIGIN" to every response served by cherrypy * Defaults to True I hope this helps! ... View more

Just out of interested, have you tried putting the hpp.macaddress=00-16-E4-12-9B-4B as hpp.macaddress="00-16-E4-12-9B-4B" (e.g. with quotes) ... View more

Ive had the unfortunate scenario where we thought a Load Balancer would be the answer. It isnt.. We thought it'd be fine. It Wasnt. 😞 As suggested by starcher - Your best bet is to create a DNS entry (e.g. splunk.ext.yourcompany.com) and set an A record for each Splunk Indexer (or Forwarder) on your boundary. I think if it was me I'd have multiple UF on the boundary (where one side can be reached by the external servers/machines and the other side can see your indexers). By setting multiple A records on the DNS entry, Splunk UF on your remote machines will round-robin their connections to the forwarders on the boundary. This allows you to scale appropriately as you can add additional A records and forwarders as required. ... View more

Sorry, cant see a description of what the independent charts look like. I hope you get this resolved. Cheers ... View more

What currently happens when you set it to independent? I would have thought that should sort it out! 🙂 ... View more

Ah okay, If you want to exclude sessions where the app crashed then I think the below might help? my_indexes type=some_mobile_brand NOT [search my_indexes type=some_mobile_brand SM_C.key=CrashUploaded | fields userId] | transaction userId maxspan=5m | stats values(userpattern) ... View more

If you are overwriting the existing lookup files in your app then you do not need to restart Splunk. When you do a lookup in Splunk (assuming it is a file-based lookup) it will take the data from within the file in your app/lookups folder. The only thing to remember is to make sure the permissions are correct and the file can still be read by Splunk as I have seen cases where people run a cronjob as root that overwrites the file and prevents Splunk from reading it. Let me know if you hit any problems! ... View more

Re-reading it again, I see what you mean now - as you will have many mounts.. ... View more

Ah I may have misunderstood your question... Is there a reason you cannot use the wildcard approach? If it is so you can specify a specific index or sourcetype then this can always be overwritten with a transform based on the hostname.. ... View more

Hi there, You can use wildcards in your monitor stanza as adonio suggested, you'll end up with something like this: [monitor:///dsto/sw/prod/webapps/jbossEAP*/servers/appname*/log/*/server.log] disabled = false sourcetype = jboss:server:log index = jboss Regards Will ... View more