Have you tried disabling the demo assets and waiting for the merge process to run? http://docs.splunk.com/Documentation/ES/4.2.0/User/Identitymanagement#Verify_the_merging_process ... View more

This likely has to do with the version of the IP Database that is being used. This database is updated with Maintenance releases of Splunk. I would recommend upgrading from 6.2 if you can. ... View more

Can you let us know the steps you tried? Open Lookup Editor Select "Create New Lookup" and select CSV lookup from the drop down Enter the CSV Name and choose the appropriate App Context Enter your CSV data and hit save. If that doesn't work can you get us the version of Splunk that you're on along with the App Version? ... View more

Have you tried scheduling the entire dashboard, or converting that specific panel to a scheduled search? You also could look into setting up DB Inputs so that data is ingested into Splunk on a regular interval. ... View more

I don't believe this would be possible, nor do I know of a setting for it. If you were ignoring anything older than 10 minutes, you would eventually start capturing data within that 10 minute window as time progressed forward. There would just be about a 10 minute delay on the data coming into your indexer. ... View more

Correct, an enterprise Trial license is Splunk Free http://www.splunk.com/en_us/products/splunk-enterprise/free-vs-enterprise.html ... View more

Unfortunately according to the documentation for DB Connect: "Splunk DB Connect has not been tested and is not supported with Splunk Cloud, Splunk Free, or Splunk Light." http://docs.splunk.com/Documentation/DBX/2.2.0/DeployDBX/Prerequisites#Splunk_Enterprise ... View more

Chris, as a best practice you should also be forwarding all logs from your Search Head to your indexer. See the following document: http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Forwardsearchheaddata ... View more

Can you let us know exactly what your props.conf looks like for this sourcetype now? ... View more

Do you have a Splunk enterprise license? What schedule is your DB input set to run at? ... View more

Can you telnet from your UF to your indexer on port 9997? ... View more

When you run your sample query while setting up the input, do you return data? Do you have an enterprise license installed? Is your query set to run a certain schedule? Have you looked at Splunk's _internal logs to see if anything is coming up related to when the query is scheduled to run? ... View more

Is the index that your host is in set to be searched by default in Your user's role? ... View more

There is an accepted Splunk Answer for this. Take a look at the following: https://answers.splunk.com/answers/34896/simple-installation-script-for-universal-forwarder.html ... View more

Just to note, it's recommended to not use SHOULD_LINEMERGE = true if you can help it. You'll notice significant performance gains by not using that setting as it rules out an entire portion of the data pipeline. ... View more

Have you looked at the spath command? That is a useful tool for parsing JSON events. It might make sense to use this to create some searches and give them a specific Dashboard to look at if you're OK with that route? ... View more

Can you explain your setup a little bit? Did you install this app on a Universal Forwarder and are trying to send data to Splunk Enterprise? Can you post your local inputs.conf file so we can see what you are collecting? Are you recieving any data from the host that the Splunk app for *nix is installed on? You can verify this by looking for that host in the _internal index ... View more

That loos like it is an extracted field or Aliased field. Have you looked to see if you have any field extractions or aliases setup for "Approval Date"? You should be able to modify or delete those if you do ... View more

I think there may have been an issue with the instructions and how the markdown language formatted it which I just corrected. The error you're receiving usually means you've entered an invalid authorization code. Take a look at the following code sample and note the highlighted section in bold. curl -X POST "https://api.home.nest.com/oauth2/access_token?client_id=f4151b70-db18-43ac-a12b-1fbcd5f1cba9&code=****&client_secret=mdM3hEligo2PfGBsOMsaHFdvI&grant_type=authorization_code" You'll want to replace that with the authorization code provided from the following URL https://home.nest.com/login/oauth2?client_id=f4151b70-db18-43ac-a12b-1fbcd5f1cba9&state=STATE Then you should receive your access_token. ... View more

Have you taken a look at this page? http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Applytimezoneoffsetstotimestamps#How_Splunk_applies_time_zones Assuming the whole chain is 6.0+, you should expect the data to use the timezone provided by the UF provided there is no explicit props.conf file specifying the timezone and if the raw event data doesn't contain a timezone. ... View more

Ideally you'll want to deploy as many changes as possible using the Deployment Server if you have one. But if you can't figure that out, than yes the changes mentioned above should get you where you need to go. ... View more