Have you considered using outlier to get rid of the edge cases?      http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Outlier Alternately, how about this: startdaysago=7 monitorid=<foo> | eventstats count(rendertime) as nresults | eval low_clipping=(nresults*0.025) | eval high_clipping=nresults-low_clipping | sort rendertime | streamstats count as sequence_number | where sequence_number>low_clipping AND sequence_number<high_clipping ... View more

As you say, searching across all directories involves a lot of overhead. Even if it would work, it's best avoided. Also, note that when you start with ..., you are not really providing a root for the search to begin. Normally a monitor stanza is going to start with a drive letter (I'm assuming Windows based on your filename). I doubt very much that Splunk will enumerate all filesystems just for the sake of fulfilling a wildcard. Your best bet would be a happy middle ground. Try to determine the directories where web.config is likely to be located, and then create multiple inputs accordingly. If you are not already aware, remember that you can use splunk list monitor from the command line to see which files Splunk has found to monitor. ... View more

Splunk is actually running on the DC? Are you using a Lightweight or heavyweight forwarder? You can use nullQueue to drop the events, but IIRC you will need to run as a heavyweight forwarder. Otherwise, you would need to filter at the indexer. Take a look at this thread: http://answers.splunk.com/questions/6179/wmi-filter-remote-eventlogs-by-host-groups Since you said you were using an LWF, make these changes on your indexer. Configure a transform to match the traffic you want to discard. # transforms.conf [drop-noise] REGEX=(?ms)host=noisyhostname.*?EventCode=5156 DEST_KEY = queue FORMAT = nullQueue Then enable the transform in props.conf : # props.conf [source://xxx] TRANSFORMS-dropnoise = drop-noise Note - I don't use LWF, so the regex may not be quite right. I would favor using "host=" over "ComputerName=" if it works, on the premise that it would be Splunk-assigned rather than part of the message body, but I'm not 100% sure host is valid here. ... View more

Generally that should work, but I'd use: [monitor:///opt/log/*/epp_server/epp_server.log] disabled = false sourcetype = EPP host_segment = 3 The ... wildcard can match multiple directory levels. * will match only within one. Adding host_segment will pull the hostname out of the file path, assuming that's what you actually want to do. ... View more

To hide the search bar, you will need to use the Advanced XML syntax. First, create a new view to drill into. If you want, you can clone flashtimeline and then just remove the SearchBar module and it's param entries. You'll also need to add layoutPanel="splSearchControls-inline" back onto the TimeRangePicker module, since you removed the layoutPanel assignment when you removed the SearchBar . Then modify your existing view (the one you want to drilldown from): If you are using Simple XML, view it with ?showsource=1 to convert it to Advanced XML. Change the value of viewTarget from "flashtimeline" to your new view: <module name="SimpleResultsTable"> <param name="drilldown">row</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline2</param> </module> </module> </module> This will still leave the search string exposed in the URL, however. If you need to hide more of it, you might try saving the search and calling it from the dashboards via | savedsearch , or using search macros to hide some elements. ... View more

You can do this in advanced XML: http://www.splunk.com/base/Documentation/latest/Developer/TableChartDrilldown If you are using simple XML, you can convert advanced XML by viewing the page and adding ?showsource=1 to the end of the URL. At the bottom, it will give you the advanced XML equivalent. Look for and remove a code block that looks like this: <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> You can do this independently for each SimpleResultsTable , allowing drilldown only on the ones where it is desired. If you're just getting started, you can paste this into a new view to troubleshoot first. When you are ready, overwrite your existing Simple XML view with the new vewsion. ... View more

The following in props.conf will do it: [yoursourcetype] pulldown_type = true Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf ... View more

As far as I'm aware it's not possible as a configuration option per-user, but that doesn't mean you can't do it. 🙂 Need to think this through a little more, but you should be able to do something along these lines: Create a separate app called dashboard . Set your new dashboard app as the default app for that user, either via Manager->Access Controls->Users or via user_prefs.conf . Make sure that all of your required dashboard views are accessible through that app context. (Either copy them, or set them to global scope) Paste the following into application.js for that app: $(document).ready(function() { Splunk.Session.instance.UI_INACTIVITY_TIMEOUT = 0; Splunk.Session.instance.timeoutDelay = 0; function overrideStartTimeout() { return; } Splunk.Session.instance.startTimeout = overrideStartTimeout; Splunk.Session.instance.stopTimeout(); }); If you really want to do it within another app like search, you can do the same thing, but wrap it in an if statement that checks the username. Getting the username may be non-trivial - usually it shows an auth token but not a name. If you have an AccountBar module, you can get it from there; if not, it may be hiding somewhere in the DOM, but I haven't seen it. I still think, however, that compartmentalizing into a dedicated app is less risky. lastKnownUser = 'unknown' function getUserName() { // Only works for pages that have an AccountBar module text = jQuery('.accountBarItems').text() r = /Logged in as (\S+)/ matches = r.exec(text) if (matches) { lastKnownUser = matches[1]; } return lastKnownUser; } $(document).ready(function() { if ( getUserName() == "dashboard" ) { Splunk.Session.instance.UI_INACTIVITY_TIMEOUT = 0; Splunk.Session.instance.timeoutDelay = 0; function overrideStartTimeout() { return; } Splunk.Session.instance.startTimeout = overrideStartTimeout; Splunk.Session.instance.stopTimeout(); } }); ... View more

If you just want the immediate alert (no historical reporting), you could do something like: | metadata type=sources | search source=yoursource | eval age=now()-lastTime | search age>60 If it returns any results, your source has not reported in a longer-than-expected amount of time (60 seconds in this case). Note: It's not clear to me whether it's preferable to use lastTime or RecentTime in the eval statement. Maybe someone else can explain the difference. ... View more

It looks like you're trying to monitor a directory, but not recurse into any of the files within it. Try splunk list monitor and see if your ERRORLOG file shows up. You don't really need a whitelist here anyway - you can use wildcards in the monitor definition. You should be able to just use a wild card in the path: [monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\ERRORLOG.*] disabled = 0 ... View more