Running pdf server 1.3 on a searchhead running Splunk 4.3.4, build 136012. I have noticed that the PDF server under system settings keeps disabling, I believe mostly after Splunk restarts. Anyone experience this issue? Thanks ... View more

Our server administrators have asked us to enable NIC bonding on our blade servers to make chassis administration more efficient. I have read the RHEL documentation about how to enable NIC bonding on the server. However before I do, I wanted to see if anyone has any experience about running Splunk on a server with bonded NIC's. We would be enabling this on 5 blades, 4 indexers and 1 ES searchhead. All operating systems are RHEL 5.8 x64. Any information concerning this issue would be appreciated. Thanks ... View more

This is my first form search view so I am still learning. I have read a few threads on answers and read up on some documentation about creating form searches in advanced XML. I am still not completely comfortable with "intentions" and other parts. I have tried creating a form search using 1 hidden search and 2 string replace (1 text and 1 dropdown). The dropdown is populating correctly from a lookup, however when I click on the time picker and click search, it gives me the error "PARSER: Applying intentions failed 'unicode' object has no attribute 'get'". I have read on answers and tried to resolve this error, but I am unable to correct it. Could someone please look over my XML and help me: See if this is even the best way to accomplish what I want Help me correct the PARSER error Thanks in advance Current XML is below: <module name="HiddenSearch" layoutPanel="viewHeader"> <param name="search"> sourcetype=wineventlog:security Account_Name=$username$ message=$message$ | table _time Account_Name Source_Network_Address message </param> <module name="ExtendedFieldSearch"> <param name="replacementMap"> <param name="arg"> <param name="username"/> </param> </param> <param name="field">Domain Username</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="username"> <param name="fillOnEmpty">True</param> </param> </param> </param> <module name="SearchSelectLister"> <param name="staticFieldsToDisplay"/> <param name="search">| inputlookup domain_messages</param> <param name="label">Domain Event</param> <param name="settingToCreate">message_setting</param> <param name="searchFieldsToDisplay"> <list> <param name="value">message</param> <param name="label">message</param> </list> </param> <param name="searchWhenChanged">False</param> <module name="ConvertToIntention"> <param name="settingToConvert">message_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="message"> <param name="fillOnEmpty">True</param> <param name="suffix"></param> <param name="value">$target$</param> </param> </param> </param> ... View more

We use tags frequently in our environment. I recently added some new servers with differing case for their host names. I tried to create tags with all lowercase characters, but the tags would never show. Once I used the exact case, the tags worked fine. However this presents issues. I would like to make the tags.conf be case insensitive. Is there a way to accomplish this without adding multiple entries in all various case possibilities? Thanks in advance. ... View more

I have two scheduled searches that each output a single numerical value to populate panels on a dashboard. I want to add a third panel to simply show the difference between the two. I have read several threads on splunk answers but none have helped me with this issue. Each search is somewhat complex and takes a bit of time to run, so I scheduled them to run and cache their results for the dashboard. I have read and tried using savedsearch and append . I have also tried to utilize OR and eval . I have read where using join is discouraged. Best case would be to simply take the already ran results and simply eval them, without have to run both searches again. Any assistance would be appreciated. Thanks. Edit: Would it help if I included the searches that are running on a schedule? Search 1: `sourcetype=a tag=prod | dedup c_uid | stats count(c_uid)` Search 2: `sourcetype=a tag=prod [search sourcetype=b tag=prod audit_event="AUTHN_SUCCESS" | dedup b_uid | fields b_uid | format maxresults=20000] | dedup c_uid | stats count(c_uid)` Search 1 will always be more than search 2, and I would like to show that difference in a panel on the dashboard. The other alternative is not to show the difference and just let the VP do the math, which isn't a good option. Thanks! ... View more