Is there a command via splunk.exe or another /bin tool to disable all saved searches on a particular splunk instance? Does splunk require some of the default searches to run? ... View more

I have a continuous repeat of the follow error in my splunkd.log: ERROR BTreeCP - failed: failed to copy/move C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db\btree_index.dat to C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db\snapshot.tmp: The system cannot find the path specified. What is the btree_index.dat and what are the implications of its failure to be copied as snapshot.tmp? ... View more

Is there a command via splunk.exe or some other /bin tool that would output all scheduled searches in a particular instance of Splunk? ... View more

I am preparing to register for the Splunk conference. I would like to attend the Full day "Developing with Splunk" class, however, it is noted as "full" on the conference page. Should I try to register for the class anyhow? If I do register for the class, will I be able to downgrade to the half-day class and get a refund on the credits? ... View more

I just set up a new splunk forwarder on a linux host. One of the inputs is a monitor of the /var/log/messages file. I have a crontab entry to write some disk information to this messages file. I am unable to find these events being indexed on the indexer. The forwarder is able to forward other events. I have a similar monitor set up to watch the /var/log/maillog file, and I find these events on the other side, being indexed. Other sorts of events are coming in. I restarted splunk on the forwarder and checked the startup events in the splunkd log. I see an entry where it says that it has begun to tail the /var/log/messages file. Does anybody have an idea why this particular sourcetype isn't being indexed? What else can I do to follow this sourcetype onto the indexer? Is there any particular error I should look for to explain why this sourcetype isn't being indexed? ... View more

I have a saved search that I modified in the Splunkweb Manager. I look at the same search in the savedsearch.conf file, and the changes are not registered there. I have performed a splunk restart from the web, and the change still hasn't shown up in the .conf file. If I run | savedsearch "<searchname>" it pulls up and runs the search as saved in the .conf file. However, the search is run on a schedule, and the scheduled search is following the Splunkweb configuration. What causes the Splunkweb saved search configuration to sync up with the .conf files, and what could be stopping it from happening in this case? ... View more

I have a line graph that charts the consumed disk capacity for many hosts. It is very nice for giving a rough idea of the trends, and if I hover over the line at a specific point in time, I can get the capacity value at that time. How would I be able to make a permanent marker or annotation at obvious points of interest? For instance, a 4% or %5 jump in consumed disk? ... View more

I would like to export a list of the fieldnames in any given search. How could I do this? ... View more

I am indexing results from facter which logs information about each host. I can get the most up to date list of these system properties by running sourcetype="puppet-facts" | dedup host This would return a single event for each host. My question is, how would I generate a table that would include a record for each host, and then columns consisting of the fields? ... View more

If I make a change to a view in an app, I can activate that change by reloading the app. If I make a change to the savesearch.conf at the system level, it requires a splunk restart before the change takes effect. Is there a simple and short way of knowing when a configuration change will go into effect? On reload of a view? On reload of server? etc? ... View more