Hi toolsops and alexantao, well the docs are pretty strait forward on this and tell you what can or should be done. To remove the error message you can: Switch to a chart type that involves drawing only one shape per series (in other words, move from a column chart to a line chart). Reduce the number of fields that are being plotted. For time charts, use a longer time-span between data points. There are additional conditions that can cause truncation: Searches that return too many results per series can cause JSChart to hang the browser. Splunk employs a throttling strategy that restricts the number of results returned per series to 500 by default. You can configure this value by going to JSChart.conf and changing the maxResultsCount parameter to something other than 500. JSChart can only plot the first 50 series that are returned. Additional series will not be plotted. Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit. For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering. The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message. Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance. You can't change the FlashChart truncation limit of 2000 objects. hope this helps ... cheers, MuS ... View more

Hi HeinzWaescher, like most of the Splunk related stuff; it all depends what you are trying to achieve. For example inline search cannot be accelerated, but can use saved search results saved searches can be accelerated, if your result supports it (like stats output) you can create a single dashboard with only one search and postprocess the result in different graphs if the base data for all graphs is the same, see this In the end it is up to your needs and some try and error approach to setup THE dashboard for your needs. Update: Not to forget the summary index and how to use it to increase report efficiency, see this docs Hope this helps ... cheers, MuS ... View more

Hi cgraham1, the fastest way is to delete events like this: yourFancySearchToGetTheIPs | delete This will make the events non-searchable, but they are still in the index. There are as well other ways, like move the events to a new index and delete the hole index....but I think the | delete command is a nice and easy way. hope this helps ... cheers, MuS ... View more

have you tried using streamstats instead of the sub search? Also, you can setup the saved search cron like meaning you run different searches on Mon then on Sat. ... View more

Did you made any progress on this topic? ... View more

and if you run the LDAP search by hand and using some other tools like cmd line or Apache Directory Studio or AD Explorer, with the filters Splunk uses, you get a result back for this user="splunktest"? ... View more

Hi rawatvineet, best thing to do here is to wait for an update of the Cisco Security Suite for Splunk 6 so you don't have to install the Goggle Maps App anymore. ... View more

don't excuse for being busy 🙂 well according to the message Splunk is not able to find the user in LDAP....are you really sure there is no typo in the .conf and the user filter is correct? ... View more

increase the log channel for AdminHandler:AuthenticationHandler, AuthenticationManagerLDAP, AuthenticationManagerSplunk and restart Splunk. Check for authentication errors ... View more

One Thing to remember, Users will only be listed on the User Page After the First Login ... View more

what are the results if you point your config back to the original / working AD? ... View more

btw, check this http://answers.splunk.com/answers/50175/ldap-authentication-troubleshooting-information ... View more

being able to see LDAP groups does not mean you will see the user object inside the group, because therefore Splunk will use the User base filter and the User name attribute. While it will use the Static group search filter and the Group name attribute for the groups. You can verify your user filter setting by running a manual LDAP search using your configured filter. ... View more

have you checked for possible typos in your authentication.conf? ... View more

Hi stevejfice, a good place to start would be to search for any LDAP related messages in splunkd.log: index=_internal source=*splunkd.log* component="AuthenticationManagerLDAP" Also, keep in mind that empty LDAP Groups will not show up in Splunk, you will need at least one object in the LDAP group. Last but not least, I simply assume your Splunk server is able to connect to the AD (excluding any routing, network, firewall troubles). hope this helps... cheers, MuS ... View more

Hi JeremyHagan, you can use the REST end point /services/admin/inputstatus/TailingProcessor:FileStatus to track if a universal forwarder is reading files monitored or completed sending events. In the end point you can find information about "open file", and others showing "finished reading". Some details about the endpoint information, when the percent is 100% : "finished reading" means that the file has been read and forwarded till the end. "open file" means the same, but in addition the handle on the file is still open (because it has been less than 3 seconds, or because it is being 'tailed', or the file has just being reopen for any update or rotation). Splunk will monitor every file, because Splunk assumes that a new event can be added to any file. hope this helps... cheers, MuS ... View more

btw, I have the gray one not the pink 🙂 ... View more

Hi pete_olds I have a Pogoplug (sounds nasty, but it isn't at all 🙂 ) running Archlinux and installed the forwarder without any trouble on it. hope this helps... cheers, MuS ... View more

btw, you now can mark it as answered - thanks 😉 ... View more

in addition find more details @ docs page http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/PackageApp ... View more

no problem... ... View more

Why not use syslog defaults for everything and use Kiwi server as receiver and use the forwarder to read and forward the Kiwi logs? This way you were 'protected' against loosing syslog data when you restart your Splunk Forwarder. ... View more

no, not if the difference is only a few minutes. Different approach, can your Kiwi Syslog server receive on second UDP Port? If so, try to receive data on UDP 515 & 516 and see if the Kiwi Syslog server gets your feed. btw I just checked your question...was your 'splunk list udp' done on the forwarder? ... View more

did you check the time stamp of your source data feed? Maybe this is messed-up and you will find your data being indexed, but events have a wrong time stamp. Did you search all-time on your index and source? ... View more