Hi joao_amorim, quick update: as of now, this is possible with DB connect v3 http://docs.splunk.com/Documentation/DBX/3.0.2/DeployDBX/Commands#procedure cheers, MuS ... View more

Hi theironcook, take a look at this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html it provides some examples how it can be done. The answer is not limited to two source ... it can be applied to endless events. Hope this helps ... cheers, MuS ... View more

change the indexes that are searched by default for your role. Most likely the dashboard searches are created without a specific index name. See the docs for more details to change the by default searched indexes http://docs.splunk.com/Documentation/Splunk/6.5.3/Security/Aboutusersandroles I will convert this to an answer, feel free to accept it Hope this helps ... cheers, MuS ... View more

Ensure that you configure it on the parsing level, either HWF if available or IDX http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings and also make sure to restart the Splunk instance you configured. Check using btool on the parsing instance to see if your props is applied correctly or if some other props.conf is taking precedence over it. cheers, MuS ... View more

Hi 493669, if you want I email you and we can solve this offline? ... View more

Hi 493669, Since you've never provided the actual search command you used, I wonder if you use the stanza name set in collections.conf instead the one from transforms.conf ? I took your posted config files and it works just fine: After adding some random values to it I can get them back as well using the stanza name from transforms.conf : Where as I get the same error as you got when using |inputlookup sample . Here are the config files used: collections.conf [sample] field.test = string field.check = string replicate = true transforms.conf [sample_store] external_type = kvstore collection = sample fields_list = test, check Hope this helps ... cheers, MuS ... View more

You're welcome, feel free to up-vote any answer or comment that was useful 😉 ... View more

Is the Splunk forwarder reading from NFS or writing its logs to NFS? Check any existing inputs.conf for an option called crcSalt if this is set it can produce duplicate events. ... View more

What happens if you remove the " around the tokens? Eq that the search looks like : index="idx_dropdown" VEHICLE_NAME=$VEHICLE_NAME$ COMPANY_NAME=$COMPANY_NAME$ MODEL=$MODEL$ YEAR=$YEAR$ ... View more

just remove the outputs.conf first and restart Splunk. If it does not help you can start from scratch 😉 ... View more

This is still not good: root@SPsvr:/opt/splunk/bin# ./splunk btool outputs list --debug | grep -v default /opt/splunk/etc/system/local/outputs.conf [tcpout] /opt/splunk/etc/system/local/outputs.conf [tcpout-server://SPsvr:9997] /opt/splunk/etc/system/local/outputs.conf server = SPsvr:9997 Is SPsvr your indexer? If so will tell the Splunk indexer to forward to itself, which is a loop. I would remove the file and restart Splunk. ... View more

use ./splunk instead of splunk ... View more

goto to %SPLUNK_HOME%/etc (where %SPLUNK_HOME% is the install directory of your Splunk) and delete the file passwd restart the Splunk service and it will re-create the file and you will be able to login using the default user and pwd which is the one provided by @ChrisG ... View more

For SimpleXML it is predefined, but I'm sure you can do it as you mentioned using the web framework. My two cents: I would simply use a table panel (maybe with some overlay and spark line?) to show the two metrics for the various numbers of servers. ... View more

On the indexer run splunk btool outputs list --debug | grep -v default , see what custom outputs.conf you have and remove it on the indexer. Then run splunk btool inputs list splunktcp --debug | grep -v default , check if everything is correct and also run splunk list inputstatus and check for tcp_cooked:listenerports which should be 9997. Restart Splunk and it should work ... View more

Hi daniel333, something like this should get you started: | inputlookup assets.csv | search NOT [ search the search to return AV logs | dedup host | fields host ] You could also use inputlookup append=t and stats to count the host search to get the av logs | inputlookup append=t assets.csv | stats dc(host) AS count | where count < 2 the second one is untested, but will handle large amounts of events faster 😉 Hope this helps ... cheers, MuS ... View more

Hi jhl226116, this looks wrong: root@indexer: /opt/splunk/bin# ./splunk list forward-server Active forwards: SPsvr:9997 Configured but inactive forwards: This tells me you enabled forwarding on the indexer but not receiving. To enable receiving on the indexer run this command: ./splunk enable listen 9997 -auth <username>:<password> And please remember to disable the forwarding on the indexer before you enable receiving, otherwise you could create a nasty data loop 😉 Hope this helps ... cheers, MuS ... View more

HI splunk403, there is a way you can selectively show or hide panels based on the drop down selection. Take this run everywhere dashboard to see how the panels change based on the drop down section: <form> <label>Show panels dynamically based on drop down selection</label> <description>https://answers.splunk.com/answers/513020/how-to-produce-a-dynamic-number-of-panels-in-a-das-2.html</description> <search id="internal_data"> <query>index=_internal earliest=-1h@h latest=now | table _time, source, sourcetype, host</query> </search> <fieldset submitButton="false"> <input type="dropdown" token="category" searchWhenChanged="true"> <label>select panel to show:</label> <choice value="1">Panel1</choice> <choice value="2">Panel2</choice> <choice value="3">Panel3</choice> <default>1</default> <change> <condition value="1"> <unset token="panel2"></unset> <unset token="panel3"></unset> <set token="panel1"></set> </condition> <condition value="2"> <unset token="panel1"></unset> <unset token="panel3"></unset> <set token="panel2"></set> </condition> <condition value="3"> <unset token="panel1"></unset> <unset token="panel2"></unset> <set token="panel3"></set> </condition> </change> </input> </fieldset> <row depends="$panel1$"> <panel> <title>Panel 1</title> <chart> <search base="internal_data"> <query>|stats count by host</query> </search> <option name="charting.chart">column</option> </chart> </panel> </row> <row depends="$panel2$"> <panel> <title>Panel 2</title> <chart> <search base="internal_data"> <query>|stats count by source</query> </search> <option name="charting.chart">column</option> </chart> </panel> </row> <row depends="$panel3$"> <panel> <title>Panel 3</title> <chart> <search base="internal_data"> <query>|stats count by sourcetype</query> </search> <option name="charting.chart">pie</option> </chart> <chart> <search base="internal_data"> <query>|stats count by host</query> </search> <option name="charting.chart">column</option> </chart> </panel> </row> </form> Hope this helps ... cheers, MuS ... View more

Hi there, did you check with btool that your config is applied? $SPLUNK_HOME/bin/splunk btool serverclass list --debug will show you what config is applied and where the config is coming from eq .conf file. ... View more

Hi splunker1981, If I create a custom command in a TA, I add this to the metadata/default.meta [] access = read : [ * ], write : [ admin ] export = system and it worked all the times so far. Hope this helps ... cheers, MuS ... View more

Yes, this is the difference between using where and search ; search can be basically used in the base/original search where as where will compare/eval values of fields ... even back in 2014 😉 cheers, MuS ... View more