Hi @jlkokko If you're doing a live search, the following documentation on specifying time modifiers should be what you're looking for. (@strive's search will do the trick) http://docs.splunk.com/Documentation/Splunk/6.1.2/Search/Specifytimemodifiersinyoursearch If you're setting up a scheduled search, a cron schedule might make more sense. http://docs.splunk.com/Documentation/Splunk/6.1.2/Report/Schedulereports#Specify_a_cron_schedule_for_report_delivery ... View more

Hi @jlkokko Are you trying do a live search or set up a scheduled search? ... View more

Hi @Ricapar The following documentation has subsections following this page that explain how to configure the secret key for a cluster via dashboard, server.conf and CLI. http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Clusterconfigurationoverview This documentation covers making changes to a cluster configuration, including the secret key and the various ways of doing so as well. http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Configurethepeers#Change_the_cluster_configuration Hope this helps! Patrick ... View more

I agree with Lucas K's approach. For this situation, it seems the most logical working with the machine data that is available which are logs of system activity for all employees. I'm assuming each employee has a specific login/ID # associated with them to track every activity across all systems. Each activity log should have a timestamp which can be used to measure and determine if they met the Block Leave requirement. For the last question in your post @carolynmcdonoughtest, is that really relevant since it's required that they "did not use any systems during that entire 14-day period"? ... View more

Hi @a212830 Glad @martin_mueller helped solve your question 🙂 I marked this one already, but don't forget to mark future/past posts as answered if they've been solved. Thanks! Patrick ... View more

Hi @khourihan_splunk I think @toddbruner's SH and indexer are currently the same version? "Just upgraded a search head to 6.1.1 from 5.0.2. (Indexers on separate system and is at 6.1.1)" ... View more

@strive just converted it 🙂 @manuzet if strive's answer solved your question, please be sure to accept it by clicking on the big check mark to the left of this thread. That way people with similar questions/issues will turn to this post for help. Thanks! Patrick ... View more

If you're using Internet Explorer 7 or 8, these versions are no longer supported by Splunk version 6.1 and higher. You can check out the supporting documentation here regarding supported browsers: http://docs.splunk.com/Documentation/Splunk/6.1/ReleaseNotes/Deprecatedfeatures#Browser_support ... View more

Hi @splunkn What version of Splunk and IE are you using? ... View more

Here's the supporting documentation on the license usage report in Splunk: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/AboutSplunksLicenseUsageReportView ... View more

What version of Splunk is your environment running? For Splunk 6.1.2, both full instances of Splunk Enterprise and universal forwarders for Windows support local collection of printer subsystem information. It can be configured using Splunk web or inputs.conf. The following documentation shows the monitoring configuration stanzas in inputs.conf and the WinPrintMon sourcetype that your indexer is expecting: http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/MonitorWindowsprinterinformation ... View more

Hi @Wallen Did the detection monitoring in the following documentation find print monitoring in your environment when you initially installed? http://docs.splunk.com/Documentation/MSApp/1.0.2/MSInfra/ConfiguretheSplunkAppforWindowsInfrastructure There should also be a Setup Menu to enable inputs: http://docs.splunk.com/Documentation/MSApp/1.0.2/MSInfra/Dashboardreference-Windows#Get_Data_In ... View more

Hi @brywilk_umich This Answers post asks a similar question to yours, but with a different approach scheduling a report for the 1st day of the month on the previous month's data: http://answers.splunk.com/answers/3280/cron-schedule-for-saved-search-on-last-day-of-month It refers to using cron scheduling from this documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/Report/Schedulereports#Specify_a_cron_schedule_for_report_delivery Hope this helps 🙂 Patrick ... View more

Glad you found your answer @jamesvz84 🙂 Please be sure to accept your answer by clicking on the check mark next to your response so other people with similar issues/questions will turn to this post for help. Thanks! Patrick ... View more

Hi @eichfuss Finding a resource that solved your question is as good an answer as any 🙂 I just put the link from your old comment and into your answer. Thanks for contributing! Patrick ... View more

Hi @lelikflegma Glad @Jeff_Lightly_Splunk helped you find a solution 🙂 Please be sure to accept his answer by clicking the check mark next to his response so others with similar issues will turn to this post for help. (and you both get karma points too :D) Thanks! Patrick ... View more

Hi @phorstap Glad @jordanperks was able to help you find your solution 🙂 Please be sure to accept his answer (clicking on the check mark next to his response) so other people with similar issues will look to this post for help. Thanks! Patrick ... View more

Glad you figured out your issue @dtolan. Please be sure to accept your answer (clicking the check mark next to your response) so other people with similar issues will turn to this post for help. Thanks! Patrick ... View more

No worries @dperry 🙂 I'm sure a lot of other people are going to have the same question or not sure where to find the answers. You can help out by accepting your answer to this post by clicking on the check mark next to your answer. That way, people with similar questions will refer to this post for help. Thanks! Patrick ... View more

Hi @spsrasru Have you checked out this post on Answers? It seems related to your issue http://answers.splunk.com/answers/50485/splunkd-daemon-is-not-responding-the-read-operation-timed-out ... View more

ah sorry I didn't realize you put the version at the bottom of your post. I wasn't sure if your issue had anything to do with the app being compatible with versions 5.0 and below according to the app's page http://apps.splunk.com/app/282/ ... View more

Hi @bwhyle Glad you got your issue solved! Please be sure to accept @MuS's answer by clicking on the check mark next to his response. People with similar issues will look to this post for help aand you both get karma points too 🙂 Patrick ... View more

Hi @neiljpeterson What version of Splunk are you using? ... View more

1)Test sourcetype and index config files to make sure they work. 2)Move the config files into the configuration bundle under the master-apps/_cluster/local subdirectory on the master node. 3)On the master node dashboard: -Click Settings in the upper right corner of Splunk Web. -In the Distributed environment group, click Clustering. -Click the Edit button on upper right corner of the dashboard and select the Distribute Configuration Bundle option. -Click the Distribute Configuration Bundle button (NOTE: The distribution may cause a peer restart) -Click Push Changes to continue. ... View more