May be this is more of a request than question to Splunk Team. As per the Splunk Free License categorization , the key things that are really missing are - Access Control and Single Sign-On - Single-site Clustering - Multi-site Clustering These three facilities are really important to demo POC's for customers and is NOT part of Free License 😞 Any chance to get these functionalities enabled as part of Free License or an upgraded license for Developers/Consultants to demo Splunk for Enterprise Systems ... View more

I have installed Splunk Enterprise in AWS for test purposes (Splunk 6.2x) . Installation was smooth and internal access working perfectly. Though Splunk put forward internal address while it started ("http://ip-172-31-40-50:8000") , i have tried accessing it using external IP (eg 54.152.7.160) External Access didn't work http://54.152.7.161:8000/ I have tried changing VPC entries, Network Inbound Traffic to allow 8000 from any source (in Default as well as in custom rule) But still it is not working. ANy idea how to get Splunk working externally in AWS? Cheers ... View more

I was trying to build a django based web front-end using the examples shown in "Splunk Web Framework Toolkit". The example shown for cascaded form is "technically" NOT a cascading search, but rather searches the "whole" data every single time. Original Example. {% block managers %} {% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %} {% searchmanager id="sourcetypesearch" search="| metadata index=$index$ OR index=_$index$ type=sourcetypes"|token_safe cache=True preview=True autostart=False %} {% endblock managers %} What it means is: The search is run everytime with value from previous selection. So its not actually cascading the search, but rather redoing the entire search !!. Is there a way we can "cascade" the search too as we do in advanced XML (or sideviewutils) ? I'm looking for something like.. {% block managers %} {% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %} {% searchmanager id="sourcetypesearch" search=$indexsearch$|token_safe cache=True preview=True autostart=False %} {% endblock managers %} whereby the whole of "indexsearch" is passed as a token to the next search , rather than searching the whole once again? ... View more

hi I'm not sure if I can put my idea into correct words or Not.. I'm looking for a good CRUD application , preferably within Splunk to provide a single pane of glass to multiple teams. Are there any good apps which uses the "django" web-framework + dbconnect to make a CRUD (Create/Retrieve/Update/Delete) functionality within Splunk? I can see a good project "django-bootstrap-crud-templates" in github. Not sure if this can be extended as an app? ... View more