could you share the search and the resulting graph, please? ... View more

Hi rbacon & gschmitz, I think the problem is your (x86) in the path, which will be handled as regex see the docs about Specify input paths with wild cards. Try using quotes around the path and / or use this fancy tool http://blogs.splunk.com/?s=christmas to debug. hope this helps ... cheers, MuS ... View more

Well, do you have the size of the files in your index=fileindex? If so please provide some samples.... ... View more

Well, in this case your original question is wrong: you asked how to view them and not how to manage them 😉 ... View more

Hi ben_leung, one way would be to create a saved search, which runs as admin user, queries all saved searches and writes its results into a summary index. Use the summary index to feed your app / dashboards. cheers, MuS ... View more

Hi rdownie, now it looks like this is possible, at least in Splunk 6.1.2 it works. See this answer http://answers.splunk.com/answers/153336/using-earliest-twice-in-one-search cheers, MuS ... View more

Hi joec90, you almost got it, stats needs to know that you used timed buckets so you need to add _time to the stats command like this: user=* clientip=* | iplocation clientip | bucket _time span=10m | stats dc(clientip) as dc_clientip values(clientip) as clientip values(City) as City values(Region) as Region values(Country) as Country by user, _time | where dc_clientip > 1 hope this helps ... cheers, MuS ... View more

Hi atixx, I don't really see the benefits of doing something like this, using three Splunk universal forwarders to forward syslog from one syslog device to another syslog. If you need to chain things up like this, stick with syslog all the way. Beside this, use the usual troubleshooting to find the error, like: All needed ports open and listening? Any Firewalls blocking the traffic? Network routes correct? On SplunkUF you're using TCP as input for syslog, is that correct? cheers, MuS ... View more

try to index the events again while running this script http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ ... View more

any nullQueue in any transforms.conf which could interfere here? check with btool ... View more

yeah sorry my bad .... did mixed up the report / dashboard here ... View more

Hi lquinn, I think starting Splunk 6.1, there is a nice feature called embed scheduled reports which does what you want. Please see the docs for more information on Embed scheduled reports. cheers, MuS ... View more

Ok, this works for me and is only an example adapt it to your needs: sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:security" ( EventCode=538 OR EventCode=4624 ) | streamstats current=f last(*) AS last_* | where EventCode=4624 AND last_EventCode=538 | stats dc(_time) values(EventCode) values(ComputerName) values(last_EventCode) values(last_ComputerName) by "Account_Name" Also, watch and double check that all field names match, like EventCode is not equal to eventcode or eventCode and start with a simple search and only search for the two EventCodes 4771 & 4740 ... View more

Hi dmcinnis, Take a look at this app http://apps.splunk.com/app/1852/ it can be used like the *nix ldapsearch command. cheers, MuS ... View more

And here it is http://apps.splunk.com/app/1852/ cheers ... View more

I will test this tomorrow. The example was out of my head. Tomorrow I have some WinEventLog available..... ... View more

can you provide some sample events and the regex used? ... View more

you're welcome ... View more

is your inputs.conf really here: C:\Program Files\Splunk\etc\appssearch\local\inputs.conf ? To set custom configurations, place an inputs.conf in $SPLUNK_HOME/etc/system/local/ ... View more