you should hide the "search links" See how-to-not-show-the-query-in-a-dashboard-to-others ... View more

you should blacklist it in your serverclass, so you don't deploy it too the server. ... View more

Your conifg looks correct. We use the same config, but never NOTICED it did work. What version are you running? ... View more

Yes you can (not recommended ) . You need to make all you indexes "searched by default" Configure it in "Settings > Access Controls > Roles > the_role_your users_belong_too"" option : Indexes searched by default" ... View more

think you need to set the following in your limits.conf [system_checks] installed_files_integrity = disabled ... View more

outputs.conf on the indexer? where would the indexer send his data too? 1) outputs.conf difference on the SH's : could be normal, just depends in what way they are configured. try splunk btool --debug outputs list Maybe te outputs.conf in a deffirent place 2) your Index load distribution. If 1 index is getting more data it could be a couple of things your outputs are not all the same in your enviroment. Are all your forwarders configured to send data too the 3 machines? you are receiving a VERY big file from 1 machine. Your forwarder will only change too an other indexer if it hits EOF. When you reading a file of serval GB's it will all go to 1 indexer. ... View more

Think you want to use a subsearch: "mysearchstring" [ search source="jobs/*" "load = 1234" | dedup source | table source ] SubSearch doc ... View more

Don't think it is possible. How does the deployment server know there is a new forwarder installed? ... View more

searching "all time" is "everthing in the past till NOW". You need to select the date in the future, like @d+10y ... View more

shouldn't it be .(run_autostat|proteus_prod_archive).*\.log$ ... View more

If the scheduled job is an alert, the retention time is also longer. What does the Job manger tell you? (if you can access, since it wil break if there are to many jobs). We notice when de SH's are very busy, the dispatch reaper will fail/doens't have time to delete everything. ... View more

What version are you running? Do you run a SH cluster? We see the same issue in our SHclluster. It is releated with syncing betweens de SH's. You're search is probably already deleted form te SH that was running it, but the Captain doesn't know that. The "popup" is that it can't find the Job-ID. We "Fix" it by selecting an other SH as master. Usually it will clean up after a while ... View more

What is your bucket size? It will only delete data if the last message in your bucket is older than 30 day's ... View more

Think I saw this kind of issues before. But what was the problem......?? Think there was a problem with the app's we tried too deploy. please check all the app's have the correct folder structure. To "debug" this: 1) remove all the apps from deploy folder. 2) add 1 app 3) deploy now repeat it till it won't deploy anymore ... View more

You can change the default password by putting in a different 'passwd' file. But you have to do it @installation time, this van never be pushed with a deployment server. ... View more

Splunk itself is also getting information by REST call to other machines, so please be carful trying disableing stuff ... View more

so if you do index=windows| table _raw You also see the milliseconds in the message? how do you collect the Wineventlog? "normal" or by xml? ... View more

Does you WinEventLog have milliseconds in the timestamp? ... View more

You pust pull the searches that are used on the dashboards from the xml. Tricky but is that it can also Use Savedsearches. we created a REST search, that lists all the dashboard with there searches that are used on them (in_line or savesearch, and what is the search). It's not exactly what you want, but you could use it to extract the searches from your dasboards. | rest /servicesNS/-/-/data/ui/views splunk_server=* | rename eai:* as * | rename acl.* as * | search isVisible=1 | fields title data app | makemv veld2 delim="," | rex field=data max_match=0 "query\>(?<veld2>[^\<]+).*\<\/query" | mvexpand veld2 | eval Applicatie=app | eval Dashboard=title | eval search=veld2 | fields search Applicatie Dashboard | dedup search Applicatie Dashboard | append [| rest /servicesNS/-/-/saved/searches/ splunk_server=* | dedup title | rename eai:* as * | rename acl.* as * | search sharing!=user | rename title as searchname | fields searchname is_scheduled search app | dedup searchname is_scheduled search app | join max=0 searchname [| rest /servicesNS/-/-/data/ui/views splunk_server=* | rename eai:* as * | rename acl.* as * | search isVisible=1 sharing!=user | fields title data app | makemv savedsearch delim="," | rex field=data max_match=0 "search ref=\"(?<savedsearch>[^\"]+)\"" | mvexpand savedsearch | eval Applicatie=app | eval Dashboard=title | rename savedsearch as searchname | fields searchname Applicatie Dashboard | dedup searchname Applicatie Dashboard ]] | fields Dashboard, Applicatie, search, searchname, is_scheduled | eval is_scheduled=if(isnull(is_scheduled),"inline-search",is_scheduled) ... View more

Chould be anything. What is the "warning" from Chrome? We had some problems after Chrome was update from v57 > v58 . Maybe some missing (empty) field in you certificate ... View more

2 options: 1) get a reset license 2) wait 30 day's (without any violations) ... View more

We have the same problem, but only a hand full of variations. So we made multiple monitor stanzas. Just wondering what would happen if you blacklist the sdk in the first one ... View more

frozenTimePeriodInSecs = 1800 What is the Timestamp of the logs? If they are older than 1800 seconds, (if they alre the only event in the bucket) ... View more