the docs says setting indexed_realtime_use_by_default = true sets indexed rt to be the "default" behavior. if this is enabled, is there still a way I can run "normal", pre-indexer rt searches, perhaps with some search argument or command? Not that I'm aware of. I believe it's only one or the other. is there a way to make indexed rt the default for a role, but allow other roles to use normal rt? I'm not aware of a way to apply limits.conf parameters to specific roles. I'm not seeing anything about that in its documentation either (http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Limitsconf ). are there any guidelines on best practices for setting indexed_realtime_default_span? None that I can find. If you don't mind me asking, what is your use case? Best practice is actually to use scheduled searches over real-time searches because real-time searches require a dedicated core. ... View more

| fillnull value="foobar" rerun | search rerun="foobar" ... View more

I've encountered this in the past, and I don't think there is a way to do a soft refresh on-demand from the GUI. You could either have your users hit refresh (F5), or you could implement an auto-refresh in your dashboard tag. Example below (value in seconds). <dashboard refresh="300"> ... View more

If this worked, please choose "Accept Answer" ... View more

In your results, if you hold the ALT key, and click on the "-" in the UserAgent column, does the drill-down search properly exclude it? If it does, copy the syntax that Splunk used to exclude it into your original search. ... View more

Yes. Stop Splunk first. Make a backup copy of the $SPLUNK_HOME/etc/apps folder and $SPLUNK_HOME/etc/users/ folder. You can then move shared knowledge objects out of $SPLUNK_HOME/etc/apps/search to other apps, using the same directory structure. For example, views under $SPLUNK_HOME/etc/apps/search/local/data/ui/views can be moved to $SPLUNK_HOME/etc/apps/YOURAPP/local/data/ui/views. For objects that are not shared, the path is slightly different. For example, user "mason" may have private knowledge objects in the "search" app, which would be stored under $SPLUNK_HOME/etc/users/mason/search/local/data/ui/views. You will also find savedsearches.conf and the like in those directories. Just move them to your desired directories. If you have a lot of objects, the easiest thing to do would be to share everything so that it's moved to the app's local folder (instead of the users' folders), and then move objects to other app folders as desired. Once complete, start Splunk and you should be golden. ... View more

Since this helped you, could you please click "Accept Answer"? ... View more

Could you post some sample data, your current search, and a mock-up of your desired output please? ... View more

You can, but for security purposes, it's not recommended. Best practice is to have a dedicated splunk user account that owns all of the splunk files. See: http://wiki.splunk.com/Deploy:EnsuringSplunkRunsAsNonRootUser ... View more

Losing fields in the comments, will add it at the top. ... View more

This is probably a stupid question, but you are running this search on the Search Head and not the Indexer, right? ... View more

I've removed "source=" from my original post, as that also could have been the issue. ... View more

This does work. Are you running the search on a user that has access to internal indexes (e.g. admin), and in an App context that has access to the internal indexes (e.g. Search)? If yes, try a longer time range. ... View more

Try this: (index=_audit sourcetype=audittrail) OR (index=_internal sourcetype=splunk_web_service) user=* action=login OR action=logout | table _time, action, user, status If action isn't extracted.... (index=_audit sourcetype=audittrail) OR (index=_internal sourcetype=splunk_web_service) user=* | rex "action=(?<newaction>\w+)" | search newaction=login OR action=logout | table _time, newaction, user, status ... View more

sourcetype="juniper" reason="policy deny" src_zone="UNTRUST" | lookup geoip clientip as src_ip | stats count as Total_Attempts by dest_port, src_ip, client_country ... View more

Try what @somesoni2 suggested? vi $SPLUNK_HOME/etc/system/local/deploymentclient.conf [target-broker:deploymentServer] targetUri = IPAddressOfYourServerHere:8089 Hit ESC, :wq, Enter Restart Splunk, then check splunkd.log and report back ... View more

Also, I'm assuming you are doing the last 30 days to smooth out any spikes that may have occurred. In which case, you may even want to use a median instead of an average. i.e. index=indexA sourcetype=sourcetypeA earliest=-30d@d latest=@d | bucket _time span=1d | stats count as count by _time | stats median(count) as DailyAvgOfMonth | appendcols [search index=indexA sourcetype=sourcetypeA earliest=@d latest=now | stats count as Today ] | where Today>=1.5*DailyAvgOfMonth ... View more

Awesome. SO I can just change the "earliest=" condition to be 30d to check the count against the daily average over the last month? Eh, you have to do a tiny bit more for that. The search you gave would be comparing the count for a full 30 days to today's count. If you want an average of the daily count for the last 30 days you need to do something like: index=indexA sourcetype=sourcetypeA earliest=-30d@d latest=@d | bucket _time span=1d | stats count as count by _time | stats avg(count) as DailyAvgOfMonth | appendcols [search index=indexA sourcetype=sourcetypeA earliest=@d latest=now | stats count as Today ] | where Today>=1.5*DailyAvgOfMonth ... View more

Strange error. Did you already start Splunk? Also, maybe try putting quotation marks around the deployment server and adding your authentication info? i.e. /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes /opt/splunkforwarder/bin/splunk set deploy-poll "deploymentserver:8089" -auth admin:changeme ... View more

What happens if you do something like: | eval datetime=strftime(strptime(tostring(YEAR_INI)+tostring(MONTH_INI)+tostring(DAY_INI)+"."+tostring(HOUR_INI)+tostring(MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T") ... View more

I might need sample data for this, but I'll try without. Does this work? deviceID="ABCD" | transaction startswith=(segmentID=0 phase=mapStart) endswith=(phase=integrationEnd)| table duration ... View more