Splunk's chart rendering subsystem is configured to only show 500 data rows by default, as each point takes a couple of pixels and it's unlikely that your display device has more than a few thousand pixels. I'm assuming that your table below the chart shows all 2160 rows of data. Are you just interested in a chart here? If so, why do you need span=20m? If not, is the table correct? ... View more

By default, Splunk should extract the standard fields for sourcetypes access_combined, access_combined_wcookie and access_common using the regex in transforms.conf called access-extractions. Since it's not parsing the data, it probably means that the regex isn't matching your log lines. If you paste a sample line, someone on answers should be able to point out why the extraction fails. Alternately, you can copy the extraction called access-extraction from etc/system/default/transforms.conf to etc/system/local/transforms.conf and tweak it to extract your fields. ... View more

You can add a custom alerting condition when you save the scheduled search. Assuming that the data in the scheduled search are all the failed login events, say from the search eventtype=failed_login . The alert condition would look like: stats count by host | search count > 3 This condition will aggregate the number of failures for each host, and filter out the hosts that have fewer than three failures. The alert will trigger if the output of the original search concatenated with the alert condition yields at least one result, which it will if any host has more than three failures. ... View more

You can't configure timestamp extraction based on extracted sourcetype because timestamp extraction precedes regex-based transformation in the index-time parsing sequence. Your best bet here is to configure the timestamp extraction based on the host IP address for the devices. Specifically, replace [SLB_AlteonOS] with [host::<device_ip>] , and likewise for Juniper_VPN. ... View more

You can certainly compute your own bucket sizes using the eval command. For example, in your case you would search: ... | eval duration_group = case(duration < 20, "0-20 ms", duration < 40, "20-40 ms", duration < 60, "40-60 ms", duration < 80, "60-80 ms", duration < 100, "80-100 ms", duration < 200, "100-200 ms", 1==1, ">200 ms") | chart count by duration_group ... View more

This depends a bit on whether you just need to export raw events or the result of a reporting/summarizing search. In either case, it's a difficult task with 4.0.x. For a raw events search, one method is to write code and be clever in accessing the REST endpoints directly to "page" through the data. For either a raw or statistical events search, you can use outputcsv to persist even more rows to disk and retrieve them directly. For 4.1.x, the CLI can emit an unlimited stream of raw events (in reverse-time order), however this data will not be CSV. This is achieved by setting -maxout 0 . For a reporting/summarizing search, the limit is 500k and can be paged through using the REST API. ... View more

"App" is the probably the wrong word here. It just means that the default for objects in this app is to appear either only in this app or to appear globally. ... View more

The search language doesn't contain branching logic like this. We'd rather rely on general purpose languages (like python or Java) to provide higher-order behavior like this. I'd suggest using the python SDK to run the search, check the condition and take action (using the already run job). As an aside, there's an argument to the head command to stop fetching earlier events after some boolean predicate is satisfied, but that's a different case. ... View more

You can check the HTTP auth tokens endpoint to see the session keys that are valid and can be used to access splunkd. https://splunk-server:8089/services/admin/httpauth-tokens ... View more

There is currently no 0% data loss guarantee possible under all possible failure conditions, though we're actively working on that by adding an acknowledgment channel back to the forwarders. Assuming only scheduled outages, as long as you have two indexers that you're sending to using autoLB lightweight forwarding, you can take down any system with no data loss. Assuming you're reading from files, you can shut down forwarders at any time without loss, as we'll keep track of our location. For network inputs, a shut down forwarder cannot listen, so the implication is clear. I'm not sure why you have a tier of forwarders here. Having that layer is typically detrimental to performance and manageability. I wouldn't tune any of the parameters unless you have an elaborate deployment with cloning. ... View more

The best way to do this is to use the fillnull command to make the desired fields dense. In this case, you could try: ... | fillnull value=NULL person infection | top person by infection ... View more

KV_MODE is only a valid option in props.conf. Its use in transforms.conf doesn't do anything. ... View more

All search-time configuration in Splunk (e.g., extractions, eventtypes, tags, macros, lookups and search commands) should live on the search head that the user logs into. These resources are automatically packaged and shipped to the indexers that contain the data. ... View more