I think that you can do this more simply using stats : "is flapping between port" | stats values(host) as seen_on by dvc_mac ... View more

You need to use the uri of the splunkd, not the splunkweb. Instead you should run: ./splunk search bob -uri https://dsc-splunksearch-01:8089 -auth <....> And to verify, look at splunkd_access.log . ... View more

You shouldn't have to tag your data as Hosts. It is just based on the "host" field that the data is indexed with. When you search for your data, what "host" is set for it? If you do a search like: | metadata type=hosts | search host=<host of your data> What is returned? This is essentially the search used to populate the dashboard. ... View more

Yes, you can use the "mvfilter" function of the "eval" command. For instance: ... | eval field_name = mvfilter(field_name LIKE "abc-%") This will retain all values that start with "abc-." In general, you can put any predicate in mvfilter, and eval will iterate through all the values of the implied multi-valued field and keep only those that evaluate to "true". ... View more

Currently the search head sees everything. We're considering adding the concept of an "search head user account" on the indexer to allow the indexer administrator to restrict what the search head can do, but this would come in a future release. ... View more

diff isn't the right way to approach it since it compares two individual events. set diff can be used for this but is often hard to use. Let's assume that you have two searches that identify the events, and we'll call them <search_1> and <search_2> . Your base search would then be: <search_1> | eval input_type="baseline" | append [search <search_2> | eval input_type="today"] | chart count by id input_type Now to answer your question, you'd add to this search: | search baseline>0 today=0 . The problem is marginally easier if you already have a field to distinguish the two types of events, as you'd just search (<search_1>) OR (<search_2>) | chart count by id distinguishing_field . ... View more

No, there is no special way to handle this other than to use a regex to direct the lines to the null queue. ... View more

Splunk never actually decompresses the files within archives to a temporary location on disk. Instead we use a library called "libarchive" that allows us to stream through the contents of archives. These streamed contents are then indexed. ... View more

You can't change the toggle via the search language, but you can achieve the same effect by using "| fields ..." to pick only the fields that you care about for your search. This will give you the same speedup as disabling the automatic field extractor. ... View more

In Splunk 4.2, we will not re-index a log file it's been compressed as we compare the decompressed payload of the compressed file to our internal file tracking database. In Splunk 4.1 and before, the best practice is to blacklist the compressed files. ... View more

By default, the user there is admin/changeme, unless you've changed it. ... View more

Assuming you want this procedure to be fully automated, you can do something like: index=foo search_text | stats count by result version | eventstats sum(count) as version_count by version | search version_count > 100 | chart sum(count) by result version This filters out columns whose column sum is > 100. If you really mean just count of result=A, version=* > 100, then it's better to use a subsearch: index=foo search_text [search index=foo search_text result=A | stats count by version | search count > 100 | fields version ] | chart count by result version ... View more

Yes. [splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273 latest=1299878274 | stats count' INFO: Your timerange was substituted based on your search string count ----- 46 [splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273.651 latest=1299878274 | stats count' INFO: Your timerange was substituted based on your search string count ----- 4 ... View more