Hi philip.wong, you can use a simple remote Splunk command to add search peers and run it in a looping script. See the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.0/DistSearch/Configuredistributedsearch#Use_the_CLI But to be able to run such a remote command, you must enable allowRemoteLogin in server.conf see docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Serverconf But if you need to / want to / have to / insist to use the REST API you can run something like this: curl -k -u <adminuser>:<password> https://<yourlocalsplunkserverip>:8089/services/search/distributed/peers -d name=<yoursearchpeerip/DNS/FQDN>:8089 -d remoteUsername=<remoteserveradminuser> -d remotePassword=<remoteserverpassword> The result will look like this: <?xml version="1.0" encoding="UTF-8"?> <!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .--> <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> <feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title>distsearch-peer</title> <id>https://127.0.0.1:8089/services/search/distributed/peers</id> <updated>2014-11-24T09:10:54+01:00</updated> <generator build="213098" version="6.1.2"/> <author> <name>Splunk</name> </author> <link href="/services/search/distributed/peers/_new" rel="create"/> <opensearch:totalResults>1</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> <entry> <title>servername:8089</title> <id>https://127.0.0.1:8089/services/search/distributed/peers/servername%3A8089</id> <updated>2014-11-24T09:10:54+01:00</updated> <link href="/services/search/distributed/peers/servername%3A8089" rel="alternate"/> <author> <name>system</name> </author> <link href="/services/search/distributed/peers/servername%3A8089" rel="list"/> <link href="/services/search/distributed/peers/servername%3A8089" rel="edit"/> <link href="/services/search/distributed/peers/servername%3A8089" rel="remove"/> <content type="text/xml"> <s:dict> <s:key name="build">213098</s:key> <s:key name="bundle_versions"> <s:list/> </s:key> <s:key name="disabled">0</s:key> <s:key name="eai:acl"> <s:dict> <s:key name="app"></s:key> <s:key name="can_list">1</s:key> <s:key name="can_write">1</s:key> <s:key name="modifiable">0</s:key> <s:key name="owner">system</s:key> <s:key name="perms"> <s:dict> <s:key name="read"> <s:list> <s:item>admin</s:item> <s:item>splunk-system-role</s:item> </s:list> </s:key> <s:key name="write"> <s:list> <s:item>admin</s:item> <s:item>splunk-system-role</s:item> </s:list> </s:key> </s:dict> </s:key> <s:key name="removable">0</s:key> <s:key name="sharing">system</s:key> </s:dict> </s:key> <s:key name="guid">SomeKey</s:key> <s:key name="is_https">1</s:key> <s:key name="licenseSignature">EvenMoreKeys</s:key> <s:key name="peerName">servername</s:key> <s:key name="peerType">configured</s:key> <s:key name="remote_session">MuchMoreKeys</s:key> <s:key name="replicationStatus">Initial</s:key> <s:key name="rtsearch_enabled">1</s:key> <s:key name="startup_time">1416801414</s:key> <s:key name="status">Up</s:key> <s:key name="version">6.1.2</s:key> </s:dict> </content> </entry> </feed> hope this helps ... cheers, MuS ... View more

Hi paul_DLB, take the docs about How to migrate as example http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/MigrateaSplunkinstance#How_to_migrate This way all the needed config files will be changed/adapted to the new server. hope this helps ... cheers, MuS ... View more

Hi tiny3001, start troubleshooting why the queues are blocked. See the wiki http://wiki.splunk.com/Community:TroubleshootingBlockedQueues or use the S.o.S. App https://apps.splunk.com/app/748/ on the indexer. As well start to setup persistent queues on the UF http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usepersistentqueues cheers, MuS ... View more

Hi hlarimer, try this: search index=av_log sourcetype=sophos_threat_events Status="Resolved" | dedup ComputerName FullFilePath | stats count(eval(Status="Resolved")) AS resolved_count count AS Total by ThreatType | eval perc=resolved_count*100/Total | table Total resolved_count ThreatType perch Maybe you need to adapt this search a bit because it is not tested 😉 cheers, Mus ... View more

Hi gnoellbn, you are still able to search, but you will get an info that the search result will not be complete because of one or more searches peers being down or unreachable. hope this helps ... cheers, MuS ... View more

Hi mohitab, did you try ... | stats first(_time) by Flight_ID Alternative to cluster you could try the transaction command. cheers, MuS ... View more

Hi splunk_worker, Yes, there is a REST command to stop a running search. Use this command to get a list of searches back: curl -k -u admin:<pwd> https://localhost:8089/services/search/jobs/ | grep '<id>' You can use the `` URL to cancel/delete this search like this: curl -k -u admin:<pwd> --request DELETE https://localhost:8089/services/search/jobs/1416293763.77 and get back a response like this: <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="INFO">Search job cancelled.</msg> </messages> </response> For more details have a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/RESTREF/RESTsearchExamples#search.2Fjobs.2F.7Bsearch_id.7D_DELETE If you just need a nice table view of the running jobs, you can do this as well from the Splunk UI using this search: | rest /services/search/jobs/ | table author, id Hope this helps ... cheers, MuS ... View more