Are you sure you only have one inputs.conf entry that pulls System event logs? If you go to event viewer on the source host, do you just see a single event being logged? ... View more

I think we need a bit more detail. There is no datetime field in your sample data. You don't really need your [source::] stanza if you already set the sourcetype in inputs.conf (which is hopefully what your file is called instead of input.conf). I'd recommend taking a look at splunkd.log for hints as to why the file is not being picked up. ... View more

I don't think you can do that in SimpleXML, but I am not sure. If you are on V6.x, you can convert your dashboard to HTML and probably implement this in JavaScript. You can create a hidden panel which runs | rest /services/authentication/current-context/context | fields username roles to get the current user name and the roles that user is part of (can be multiple) and then set the refresh property. Note: I have not tested whether dynamically setting the refresh property will actually work, or whether the value is only read once when the dashboard loads. Easy enough to try. ... View more

you can use whatever values you need for your earliest/latest search timeframe constraints. This answer here, I think, is what you are really asking, i.e. how can you put the report timeframe at the top of a report so that it gets captured in the PDF when delivered. The answer shows how to use a single-value panel at the top of your report that you can populate with the String you wish to use. I showed you above how to put together that string. BTW, what version of Splunk are you using? ... View more

Hi DaClyde, unfortunately, the app does not have a built-in way to skip data verification steps. However, the only thing the app does is run a couple of searches for the relevant sourcetypes with a | head 5 at the end. So if you create a dummy data file with at least five events and index it into a test index with the expected sourcetypes such that the validation searches can find them, you will be able to get past that hurdle. Not pretty, agreed, but currently the only workaround. ... View more

Oh, and yes, you need to refresh Splunk after making changes to cached objects like .js and .css files (amongst others). You can restart -or- invoke the yourhost:port/en-US/debug/refresh URL -or- invoke .../en-US/info and click on EAI Object Refresh (same thing as 2.) ... View more

Did you follow the "Table Cell Highlighting" Example dashboard? Did you make sure that the changes you made to the .js file are reflected in your .css file (i.e. the class names are the same)? You should be able to simply do: var value = cell.value; // Apply interpretation for number of historical searches if (cell.field === 'Type') { if (value === 'Accident') { $td.addClass('range-cell').addClass('range-severe'); } else if (value === 'Congestion') { $td.addClass('range-cell').addClass('range-elevated'); } else { $td.addClass('range-cell').addClass('range-low'); } } and make this example work for you without changing the sample css. Make sure you reference both the .js file (script=) as well as the .css file (stylesheet=) in your simple XML element and put .js and .css file where they need to be. Maybe share your .js and .css if you still don't have any luck? ... View more

To manually rebuild, go to Settings->Data Models, expand your (accelerated) data model and click on "Rebuild". Screenshot here ... View more

Details here ... View more

Yes it does, especially if you installed it more than 60 days ago. Authentication features are disabled after the trial period. ... View more

Are you saying that if you are clicking on your username next to "Messages" in the top right, you don't see two options: "Edit Account" and "Logout" ? ... View more

Attitude check, please. Of course you can specify fieldname=value in a search using fields extracted at search time. That's one of the biggest values of Splunk to NOT define schema (fields) at index time. And if you feel the documentation is lacking, I encourage you to post a comment on the page to point that out. ... View more

What Splunk component is hosting your TCP data input and what constitutes "health at a deeper level"? I am pretty sure that if you can establish a TCP connection to a port assigned to a TCP input on an indexer, you could take that as a very good sign that this thing is up and running and will process data sent to it. I am not aware of any health probe message you could send which would respond with a predefined "I'm here, I'm good" message, nor am I aware that that was ever reason for concern. You cannot do searches against a splunk port setup to listen for a TCP (or UDP) input stream, but I maybe misunderstanding what you are saying. Is your "round the back" idea to send some eyecatcher message to the port, then run a search to see whether that message was indexed? If so, I would keep it simple.... 😉 ... View more

I'm not sure I understand, but doesn't the summary have a timestamp in the first line you could grab: Audit file /bkp_risc/oracle/audit/oraprod/oraprod_ora_10486100_20140630175559131361143795.aud (2014-JUNE-30 17:55:59)? ... View more

Sounds like either a typo somewhere in the configuration or a permissions/visibility issue. Can you post props/tranforms and directory listing of your .../etc/apps/search/lookups directory? ... View more

I am also challenging you on the need to add an indexed field. If you care to explain: why do you think you need it and what benefits do you expect? In any case, I would recommend reading this, specifically the "Caution:" section at the top of the page. If you still feel you have a requirement for index-time fields, the doc contains all details on how to go about it; including examples. ,I would also challenge the need for an index-time field here. But if you insist and have a good reason, this has all the caveats, warnings and detailed instructions on how to go about ignoring those warnings; along with examples. ... View more

Does the 'submit' example here not meet that need? ... View more

Hmmm, I seem to remember a related question a while ago that led me to look and it appears that local.meta only contains the last modification time. But that may be good enough. How about indexing all metadata directories with a little (CRC) salt? That may be a good exercise in coming up with props/transforms for these... 😉 But then you could probably run a search that identifies all saved searches that are old (modtime) and haven't run in a while (index=_audit) and check with owners/delete. ... View more

As MuS mentioned in his comment: useother=f doc link ... View more

There are Splunk users that use a source control system as the source for deployment server and give their staff access to modify and check-in changes to knowledge objects under source control, which will subsequently be pushed out. Maybe that's another avenue you can investigate. ... View more

You have to decided to manage SH configuration via deployment server, so your path is set for any app that is under DS management; you will have to modify/extend it at the source. As you noticed, deployment server will detect changes made to deployement apps and clients will pull those changes down and overwrite changes made locally. That is really one of the key concepts why DS exists. There is no reason why you cannot have a separate public community app that is not managed by DS, where users on the same search head can create and share knowledge objects to address this use case. ... View more

Yes: dboutput is your friend. ... View more

The first thing I would do is to remove your throughput limit set in limits.conf: maxKBps = 256 means you are not getting more than 256KBps out the door. Try removing the limit by setting maxKBps = 0 If you are still seeing messages about queues being blocked, your indexer simply cannot keep up. This can have various reasons, but most likely Splunk either has issues parsing your events (timestamp extraction, etc.) or it cannot write to disk fast enough. Can you share the hardware specs (including disk) for the machines running your indexers? Do you have the Splunk on Splunk (S.o.S.) app installed in your environment? If not, I recommend you do that as it gives you valuable information about the indexing performance of your cluster. ... View more