Hi helenashton, So, based on the comment you want to set a TZ for a specific host for a certain sourcetype. This is un-tested so I'm not sure if it will work, but this is what you can try. props.conf [YourSourceType] TRANSFORMS-001_YourSourceType_set_TimeZone = YourSourceType_set_TimeZone transforms.conf [YourSourceType_set_TimeZone] SOURCE_KEY = MetaData:Host REGEX = MyServerNameToSetTZ DEST_KEY = MetaData:TZ FORMAT = UTC This will use the transform on YourSourceType and the REGEX should match the hostname. The DEST_KEY sets what will be re-written and the FORMAT will be the new value used in this field. Hope this makes sense and helps ... cheers, MuS ... View more

Yes 🙂 wait some minutes and you get the answer .... ... View more

Short answer: No. But maybe you should explain a bit more about why you want to do so or what your final goal is? ... View more

Sub searches are really expensive searches and they have limits; You can most likely replace it with a stats , streamstats or eventstats search. Read more here: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html cheers, MuS ... View more

I don't know what you're missing? Configure ServiceNow to integrate with the Splunk platform: http://docs.splunk.com/Documentation/AddOns/latest/ServiceNow/ConfigureServiceNowtointegratewithSplunkEnterprise Install the Splunk App for ServiceNow on Splunk Enterprise: http://docs.splunk.com/Documentation/ServiceNow/4.0.1/Install/Installon-prem ... View more

Update: It's possible now http://docs.splunk.com/Documentation/Splunk/6.3.2/Admin/Alertactionsconf pdf.logo_path = <string> * Define pdf logo by syntax <app>:<path-to-image> * If set, PDF will be rendered with this logo instead of Splunk one. * If not set, Splunk logo will be used by default * Logo will be read from $SPLUNK_HOME/etc/apps/<app>/appserver/static/<path-to-image> if <app> is provided. * Current app will be used if <app> is not provided. ... View more

Hi akanno, This is NOT the solution for this problem! This will only work for you and should not be used by default. It would be better do understand why your LDAP server returns those results. So if you want to have the real solution and are willing to help I can have a closer look at it. BTW I'm currently updating the Add-On anyway so this would be a good 'fixing' 😉 cheers, MuS PS: Please un-accept this answer since it is NOT correct! ... View more

You're right, got the wrong - sorry. Well to be honest: no one, besides you, can answer this for your use case and environment. Setup two dashboards, one using post process and one using loadjob and to some tests with your data in your setup. You will soon see what is the best setup for you..... ... View more

Hi vamsi92, you can find all needed information in the docs about the App for ServiceNow http://docs.splunk.com/Documentation/ServiceNow and the Add-on for ServiceNow http://docs.splunk.com/Documentation/AddOns/latest/ServiceNow/About Also worth reading this part of the docs http://docs.splunk.com/Documentation/ServiceNow/4.0.1/User/Commandsalertactionsandscripts Hope this helps ... cheers, MuS ... View more

Hi rjthibod, using a global search and post-process has limits regarding the results, see docs http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/Savedsearches#Post-process_searches for more details. Using the loadjob approach has advantage if you use it in dashboards that are used by may people, this way the schedules saved search runs only once and everyone can use the result (eq. lesser network traffic between SH and IDX and lower performance impact if the dashboard is used by 200 or more people for example). In the end it all depends on your use case ... Hope this helps ... cheers, MuS ... View more

Hi a212830, index=_internal will provide data for the last 30 days (that's the default retention for this index). If you search like this: index=_internal sourcetype=splunkd deployedapplication you will get a nice bunch of information out of it. Hope this helps ... cheers, MuS ... View more

use after the first | a table command and list only the fields you need: index=_internal | table myfield1 myfield2 myfield3 | stats values(*) AS * by _time | transpose | rename column AS field | rename "row *" AS value* ... View more

Hi fairje, check out this answer https://answers.splunk.com/answers/129614/how-can-i-restart-all-my-forwarders.html which provides two options to do this or this answer https://answers.splunk.com/answers/91160/restart-a-uf-via-cli-other-remote-means.html uses remote REST calls, which could be scripted as well. Hope this helps ... cheers, MuS ... View more

check the sourcetype does match and SED-alter is unique ... View more

Nice! forgot about this one and can add another solution which is working: [ | gentimes start=-1 | eval foo="index=_internal | head 10 " | fields foo | rename foo -> search ] rund this litsearch in the end: litsearch index=_internal | head 10 | fields keepcolorder=t "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server" ... View more

Hi dmittel, if the the events always have the same pattern like \device\volume\name you can use this little regex: \\\w+\\\w+\\\w+ which will get \Device\HarddiskVolume23\Test1 from all provided examples. Hope this helps ... cheers, MuS ... View more

Hi daniel333, if you're on Splunk 6.3.x take a look here http://docs.splunk.com/Documentation/Splunk/6.3.2/Capacity/Parallelization#Batch_mode_search_parallelization and learn how to turn on search parallelisation Hope this helps ... cheers, MuS ... View more

You're welcome. Feel free to accept this answer - thanks 🙂 ... View more

Did you check the documentation of the App? It states: Python ldap module used in this app https://pypi.python.org/pypi/python-ldap/2.4.19 so make sure you meet all dependencies. I heard of this before; in the latest releases of CentOS the GLIB version changed and hence the GLIBC_2.14 is not available. ... View more

Hi xiangtaner, you can set in transforms.conf http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Transformsconf the case_sensitive_match option to false (it's true by default) If set to false, case insensitive matching will be performed for all fields in a lookup table or use an eval before the lookup : your base search here | eval field=lower(field) | lookup ..... Hope this helps ... cheers, MuS ... View more

Correction: It will not work! From the docs http://docs.splunk.com/Documentation/SA-LdapSearch/latest/User/Platformandhardwarerequirements#What_versions_of_Splunk_does_the_add-on_support.3F The add-on does not support AD Lightweight Directory Services (AD LDS) or other Lightweight Directory Access Protocol (LDAP) server types. ... View more

How about the & in the path name, does this work? I can remember a bug which did not like $ in path names. ... View more

HeHe, twice good spotting @lguinn ... View more