I use the following in my javascript when using drilldown. Not sure if this also applies to your scenario value, value2, name, name2 ... View more

try including the trim search command in the usernames to see if there are spaces after them. Eval UserName=trim(SqlServerLogon) Eval UserName=trim(UserName) ... View more

I would recommend setting the following setting if you would like to control the size of your index in indexes.conf [indexName] maxTotalDataSizeMB = 250000 http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy ... View more

I believe it is referring to if the disk space within the machine that the index(or drive) is on falls below a certain amount of MB, then pause indexing. ... View more

The search may be truncating it. Perhaps maxvaluesize (limits.conf) See http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Limitsconf Also wanted to note that I found a similar post that helped others here: http://answers.splunk.com/answers/60064/json-event-truncate0 ... View more

did you attempt to restart splunk by chance to see if it shows up? ... View more

You should check out this app(S.o.S): http://apps.splunk.com/app/748/ ... View more

I do not believe so. Here is a good reference file http://docs.splunk.com/Documentation/Splunk/6.0/Installation/InstallonWindows ... View more

did you restart your splunk after installing? ... View more

Click on apps dropdown on the top left. click manage apps. Go to find more apps online. You can search for the app you need using the top right box, or click "Install" by the app of your choice. The app may have you download a file in which you will need to click on the apps dropdown on the top left, click manage apps, and "Install app from file" ... View more

alternatively you could set "expiration" times, or expiration per amount of data, by default data is stored for 6 years. http://answers.splunk.com/answers/4236/how-to-deleteoverwrite-data-older-than-x-number-of-days http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy ... View more

if they all start with a date and "engine version" you could potentially set it up to break only before a regex of the date and word Engine ... View more

I'm getting this Warning too many times within my log files: WARN BundleArchiver - Filtered nothing out of C:\Program Files\Splunk\etc\apps\maps\metadata\local.meta, but size still changed: original_size=92, filtered_size=84, cosmetic_bytes=1 WARN BundleArchiver - Filtered nothing out of C:\Program Files\Splunk\etc\apps\sideview_utils\metadata\local.meta, but size still changed: original_size=322, filtered_size=302, cosmetic_bytes=3 ... View more

Yeah it is a bug per araitz reply above ... View more

have you tried Splunk Mobile? http://apps.splunk.com/app/738/ ... View more

I believe you are correct, our antivirus is locking many splunk files causing splunk to not work correctly. Since I'm pretty sure this is the issue I am going to mark this as answer, Thanks! ... View more

So I found that lookup tables are very picky. If they exist at an app level, they are only available for that app, no matter the permissions. If you replace a lookup table, you must open the definition and automation and re-save them One way to make them "less" picky is to put them at the system level, this makes them available in all apps. .. more info on that here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources If you need to package the app, i found it necessary to add the lookup file/definition/automation to each app. ... View more

I add the following outside the brackets: where datefield > "12/1/2010 00:00:00" {AND $rising_column$ > ?} Then you can set the retention on the index. ... View more

Make sure that the permissions of var/run and var/spool (and all their children) are correct. We found that ours had no permissions and adding these permissions fixed this issue, but not for all new search logs, they are created with no permissions and I think this is the issue. No knowing what causes this. We found this to be an issue with our anti-virus locking files as they were created in the directories: If this solves your problem, feel free to vote up sciurus post. http://answers.splunk.com/answers/113539/error-spamming-splunkdlog-error-process_search ... View more

Somehow the directories (and all the child directories/files) of "var/run" and "var/spool" lost all permissions. Giving Permissions to System/Administrator of the folders and their child folders may have fixed my issue. Edit: It appears that all of these files are being created automatically with no permissions, When splunk tries to read them it can't find them. This appears to be a bug in Splunk and is happening on my own machine and my Dev Machine. ... View more