I typically see this problem under two conditions. If the csv has been delete. if an automatic lookup is reference a csv which is private or out of its application scope. To fix this error simply find the lookup then the csv it referencing and make the csv global or app with read permission for everyone. ... View more

All of that can be done but some of the navigation and mapping are not built in to simple XML and require the use of the Web Framework. ... View more

@kearaspoor, The only thing i could think of is more indexer and faster disk, but there are few things you can do to improve search performance. Always use fast mode. Be specific and don't use extracted fields. Example ip=255.255.255.1 which uses an extracted field instead use "255.255.255.1". Full example index=foo sourcetype=bar AND (255.255.255.1 OR 10.98.87.1 OR 78.100.89.5). Try it you will see a significant increase in performance over using key=value. use NOT to exclude events you don't need need such as success. Example: index=foo sourcetype=bar AND (255.255.255.1 OR 10.98.87.1 OR 78.100.89.5) **NOT "success"**. If those string occur in other fields add a where statement ...| where isnotnull(ip) Lastly you can use the return command to run a subsearch for certain fields and return the value into a main search. Example: *index=firewall sourcetype="firewall" [ search inputlookup SampleIPs.csv | return 300 $SampleIPs ] | where isnotnull(source_address) * What the return command is doing is return a string (10.1.3.5) OR (10.67.89.145) OR (89.76.222) And when combined the with your base search it looks something like this index=firewall sourcetype="firewall" (10.1.3.5) OR (10.67.89.145) OR (89.76.222) Hope this helps. ... View more

it looks as if you tokens are not being honored. Using the console inspect the token model using the following. console.log(mvc.Components.getInstance("default")); This should let you view all tokens for that page. ... View more

At what point do you experience the error and do you know which search instance is creating error? If you do i would use jconsole to print the object and inspect the search job properties. ... View more

Are you creating or managing search jobs through your javascript? ... View more

Do you mind posting your xml? ... View more

Hello @helge, I believe there are some bugs with the Splunk 6.x Dashboard Examples, and needs to be updated. As of 6.2 the Simple XML <earliestTime> and <latestTime> elements have been deprecated and replaced by <earliest> and <latest> elements. See the deprecated feature list. Many of the dashboards examples still use earliestTime. The app has not been updated since Oct. 28, 2014. If you update the panels to use the new elements it should work. Be careful when upgrading as a few Simple XML tags have been deprecated in favor of new ones. ... View more

tskinnerivsec is correct. _time, host,index, splunk_server, sourcetype, and source are all fields performed during ingestion (index time). ... View more

Unfortunately, not within Splunk core, that I know of. That said you could write some javascript which could detect the logged user/ role and update the css to the appropriate color scheme. ... View more

For deploying anything to $SPLUNK_HOME/etc/system/local I would recommend using a configuration management suite such as chef, puppet, or sccm. There is no way of managing $SPLUNK_HOME/etc/system/local through Splunk Deployment methods. If configuration management software is not an option you can also use splunk remote cli to set the deployment client. For the remote cli to be available the default password must be change on every forwarder. Then you would also have to script it to run for all forwarders. ... View more

Possibly, depending on how many steps it takes to match. If it takes 50 steps probably not, but it it takes 2500 steps to match per events then, possibly. Just look at when you do a fast search vs verbose/smart. The more regexes you apply and the less effecting the regex the slower your searches. ... View more

You can use the map command. ... | top 10 customer | map search="search ... customer=$customer$ | chart perc95(timeTaken) by action, customer " ... View more

Use macros and eventtypes. ... View more

Yes, you can change service user, but you must make sure the user has permission to run powershell, perfmon, access windows event logs, WMI, etc. Additionally you will have to use iCacls to give ownership of the $SPLUNK_HOME directory to the new user. ... View more

You could try something like this. ... | eval locationB=if(LOCATION=="locationB",value, isnull())|locationA=if(LOCATION=="locationA",value, isnull()) | bucket _time span =1d | stats avg(locationA) as locationA, avg(locationB) as locationB, avg(value) as ALL by _time ... View more

typo you need a eval. *eval purchasedYesterday=(rt>ts, userID, null()) * ... View more

?: is a non-capturing group. ... View more

I see you already you have accept an answer but here is another way. ... | eval rt=relative_time(now(),"-1d@d")| eval ts=_time| eval purchasedToday=if(rt=<ts, userID, null()) | purchasedYesterday=(rt>ts, userID, null()) | table userID, purchasedToday, purchasedYesterday | selfjoin userID | stats dc(userID) as TotalDC, dc(purchasedToday) as purchasedTodayDC, dc(purchasedYesterday) as purchasedYesterdayDC ... View more

If that is how your raw data looks like you probably want to use the extract command. ... | extract pairdelim=",", kvdelim="=" mv_add=true http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Extract ... View more

This should work .... | bucket _time span=1h | stats sum(COUNT_SENT) as tcs sum(COUNT_RECEIVED) as tcr by _time | eval total=tcs+tcr ... View more