Hi glentes, Based on the current known issues : http://docs.splunk.com/Documentation/Splunk/6.4.0/ReleaseNotes/KnownIssues , this particular one doesn't look to be one of them. I would make a small non-impactful change to one of the apps, and attempt a reload deploy-server to see if that prompts a refresh of the number of deployed apps panel. Please let me know if this answers your questions 😄 ... View more

Hi Splunker9999, each app has a default view. A splunk installation has the "launcher" app set as the default app. You can change this to a different default app, with a different default view if you want, as described in the answer here : https://answers.splunk.com/answers/79581/set-default-app-by-role.html Please let me know if that answers your question! 😄 ... View more

HI lisaac, you'll find some good information in Splunk's Docs here : http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/Migratefromstandalonesearchheads Essentially, it's a matter of sorting out and potentially merging together the various apps from the separate searchheads, and then transferring the collected configuration to the newly created Searchhead Cluster. Please let me know if this answers your question 😄 ... View more

Hi d_vijaya, You can look at the internal log for the license master to get an idea of how many systems are utilizing the license. This search should do it: index=_internal host=YOUR_LICENSE_MASTER component=LicenseUsage | stats sum(b) by h This will give you a table of all the bytes used by host. Please let me know if this answers your question! 😄 ... View more

Hi himapate, I believe the issue is that you need to make the lookup in question available. This seems similar to a previous question : https://answers.splunk.com/answers/298992/how-do-you-resolve-the-error-the-lookup-table-wind.html The splunk app for windows infrastructure can be found here : https://splunkbase.splunk.com/app/1680/ Installing the app or otherwise extracting the windows_event_descriptions.csv should resolve the issue. Please let me know if this answers you question! 😄 ... View more

Hi Aaron, if you wanted a quick simple count, this might be a good use for tstats, which will usually finish faster than a normal search. | tstats count where sourcetype=syslog by host ... View more

Cool, so when the user clicks the dropdown, they will have access to the description of the dashboard 😄 ... View more

Hi jsbollard, That error doesn't seem to be related necessarily to Enterprise Security, but rather some scripted input. I'd scrutinize your input definitions, specifically any one of them that mentions powershell. If the scripted input isn't working, you can disable for the moment in order to avoid the error message (or otherwise figure out why it's failing). Please let me know if this helps! ... View more

HI Paduka, Yup, each dashboard has a "description" field that can be set, and when in the "dashboards" view of an app (app/appname/dashboards), each dashboard has the opportunity to be expanded. You don't get a mouse-over tooltip or anything, but the description will be available in the dropdown. In this way, if the name of the dashboard is interesting, they can click the dropdown to get more info. Beyond that, my advice is to be fairly verbose with the dashboard name. Please let me know if this answers you question 😄 ... View more

Hi Mark, I believe you will want to use the dbquery command to get your initial events, and then pipe it to stats values to get the set of %busy by system. Like so: | dbquery "TQOMA" "SELECT "System", "%busy" FROM TQSTDBO.CPUVMSUM where "System" LIKE '%ntx%'" | stats values(%busy) by System Or at least, something along those lines. Join is used to make a table with two data sets, joining on a particular common field, which I don't think is exactly what you are after in this case. Please let me know if this helps! ... View more

Hi John, the table command doesn't offer anything in the way of formatting. Although the normal event viewer displays multiline events properly, once piping to table, the table command displays the fields without line breaks. Please let me know if this answers your question 😄 ... View more

Hi koshyk, if Splunk even starts without having access to the defined Cold Volume, my expectation is that it will fail when it initiates the warm to cold bucket rollover process, or when someone searches within a timeframe that includes a cold bucket (Splunk goes to open read on cold bucket, can't find it, fails). As a workaround, you might be able to temporarily define a folder on the Warm volume to use for cold, and then once you have your cold volume move those buckets there and reconfigure everything back. Please let me know if this answers your question! 😄 ... View more

Hi a212830, the NO_BINARY_CHECK is a props.conf configuration, and so you will want to create a stanza in props like: [source::C:\Temp\w32tmdebug.log] NO_BINARY_CHECK = true However, I'd take a closer look at this log file. The encoding is probably screwy and therefore is throwing off Splunk. Windows logs can be tricky like that. Please let me know if this helps! ... View more

The rolling restart essentially runs a "splunk offline" on each indexer one-by-one. An "offline" of an indexer cluster slave is a controlled shutdown, where all buckets that it is assigned as primary for are transitioned to another slave, and buckets are replicated as needed to maintain the rep factor, or made searchable as needed to maintain the search factor. This is most of the fixup tasks. With that being said, and in particular for large clusters, a rolling restart can be quite traumatic, especially if you are glued to the Cluster Master console. The cluster will eventually recover most of the time, and so its probably best to kick of the restart, make sure it actually took, and then give it 5 minutes before checking in. Please let me know if this answers your question! 😄 ... View more

Generally a lookup is the preferred way of going about something like this, but if that isn't an option, you could make the host field multivalue, and append the IP delimited by a '|', i.e. # inputs.conf [default] server = myhostname.mydomain.com|192.168.1.100 And then extract as needed at search time. Alternatively, you might be able to setup something to add an index time field. by something like: #transforms.conf [ip_field_set] FORMAT = ip_address::192.168.1.100 WRITE_META = true REGEX = (.+?) #props.conf [default] TRANSFORMS-ip_field_set = ip_field_set Or you could do some sort of combination, setting the source servername as a multivalue field, and then down the line setup props/transforms to extract the IP to a new field, while shortener the hostname to just the hostname. Please let me know if this helps in any way 😄 ... View more

glad to help 😄 ... View more

Hi dsollen, I'm not exactly a Splunk Developer, but I've been working with Splunk for a while, and I don't believe there is any very clean solution to defining boolean type fields. What I usually see is either relying on a literal true/false string, and then relying on a lack of typos when later evaluating. Something else I've seen, which might end up working out better for whatever you are trying to do, is to determine true/false based on a string being null or not. This will sidestep typos as the presence of any characters at all would equate to true. Please let me know if this helps, or if you have any other questions 😄 ... View more

maybe timechart perc75(time_in_ms/1000) ... View more

ah, try forwardedindex.2.whitelist = indexforthisspecificpurpose ... View more