I had the same need, and came up with a script to do it half automatically. http://answers.splunk.com/answers/200640/how-to-schedule-customized-dashboard-views-to-grou.html I haven't yet published the code, as it needs some cleanup. ... View more

ok, that's the "workaround". But it looks like a bug to me? Any splunker to shed some light on this behavior? ... View more

Same here (version 6.1.3). I had two online searches, not overly complicated, but they didn't show up in the sheduled reports (sent via the sendemail command). Moving them to saved searches (not sheduled, jobs/artifacts deleted), the pdf now includes the data. ... View more

here I still have the problem, version 6.1.3 ... View more

Ok, I've looked at the python code generating the PDFs (Splunk 6.1.3), and could make a change to force top-aligment: splunk@hostname: [~/lib/python2.7/site-packages/splunk/pdf]> diff pdfrenderer.py.old pdfrenderer.py 365,367c365,369 < if columnVAlignments is not None: < for i, valign in enumerate(columnVAlignments): < tableStyleCommands.append(('VALIGN', (i, 0), (i, -1), valign)) --- > # if columnVAlignments is not None: > # for i, valign in enumerate(columnVAlignments): > # tableStyleCommands.append(('VALIGN', (i, 0), (i, -1), valign)) > for i in range(0,numDataCols): > tableStyleCommands.append(('VALIGN', (i, 0), (i, -1), 'TOP')) So basically, the reporting engine (reportlab's pdfgen) is using as default the 'BOTTOM' cell alignment in tables. The PDFrenderer Script in Splunk has the possibility to overide this default, but somehow doesn't do it systematically. The above patch sets the alignement for every colomn to 'TOP', whatever arguments would have been passed by other scripts. I have absolutely no idea what these arguments to the tableStyleCommands mean, but it works... I'm not sure if this will have any side effect, so if any Splunk employee could add a comment, that would be great. Even better if this could be included in future releases 🙂 ... View more

Splunk version: 6.1.3 ... View more

lots of sources, actually could also have triggered lots of hosts, as the hosts were extracted from the filepath... Splunk version is the latest one, 5.x syslog was written to files, and the files indexed, no direct TCP input sourcetype was fixed (syslog) ... View more

yeah, thought about it too late... ... View more

yes, we did clean also all the files to avoid reindexing. I was also thinking about the fishbucket, but had difficulty to understand how it would be related to a search... Another possibility was that actually it was still the indexer that had a problem, and blocked some resources from the searches... ... View more

yep, that was it, missing "tabs" module (available in version 2.x of sideview utils) ... View more

Hi Yanick, yeah, a little bit everywhere 🙂 If you could do a grep for date_hour on your files, you will find them. (I currently do not have command line access to the server... can't do it myself). Regards, Stéphane ... View more

rock'n roll, it's working! also with auto: * |head 1| eval in="0;1,000;2,000;4,000"| makemv delim=";" in| mvexpand in | table _time in |convert auto(in) | streamstats sum(in) I suppose that timechart is applying auto() by default. Thanks! ... View more

Couple of months later, I learned some more. the above file split for the central syslog proved to be a disaster for splunk. Somehow, it generated thousands of sourcetypes (because syslog generated thousands of different service names). -> This lead Splunk indexes to be completely fubar (any single search just consumed all CPU) Fresh start: we are now keeping standard syslog messages in a separate tree (for archiving purposes), and dumping everything else in one syslog file per host. These files are then regularly rotated, and after two rotation discarded (data is in Splunk, and in separate archive) This looks now much better. Sourcetype is fixed to be syslog. Not as fun as automatic sourcetype detection, but hey, these are really syslog messages... I've also just read the following blog entry: http://blogs.splunk.com/2010/02/11/sourcetypes-gone-wild/ which explain how I could now extract from this single stream of syslog different sourcetype per event. And probably reroute them to different indexes... Question: how expensive is it to run regexp on every event during indexing? ... View more

Hi Jerrad, I'm trying another rsyslog approach, but I'm also stumbling on some issues. (http://splunk-base.splunk.com/answers/41415/sourcetype-too_small-and-log-rotation-on-rsyslog-server) How is your setup going on? Do you have something working? Steph ... View more

Is there a way to remove this limitation for app related tags? I want to ask a question to the developper of an app, but as it is brand new, the app- tag doesn't exist... (specifically, it's about app-puppet-simony) ... View more