In the dbx log from the time the input was saved to the entry you posted above, do you see anything strange? Do you see anything in the splunkd.log? Is the index still empty? Does the query work from DB Connect > DB Query? I know that sounds like a dumb question, but just verify it. ... View more

More details on which dashboard you would like to send, and how often you'd like to send it would be good. ... View more

What you are seeing is the effect of having two fields named Account Name. The count for - will equal the sum of all other Account Names. Use this to check the first entry for a value, and if its null then get the second entries value: eval User = if(isnull(Account_Name), User_Name, mvindex(Account_Name,1)) This will create the new value User, but you will probably have to 'View all fields' to see it. The User field will not contain -. You can find more information here: http://answers.splunk.com/answers/2649/same-fields-with-different-values-in-one-event ... View more

The original question stated, "create a new summary scheduled search", and to me that means edit(write) to the dma_summary index. Perhaps it is a 'createnewbug'. ... View more

Expecting write(indexes_edit) when granted only read(explicit) does not compute. ... View more

What are you seeing in the splunkd.log files on the forwarder and indexer? ... View more

[tcpout] defaultGroup=indexer1,indexer2 [tcpout:indexer1] server=10.1.1.197:9997 [tcpout:indexer2] server=10.1.1.200:9997 The forwarder will send duplicate data streams to the servers specified in both the indexer1 and indexer2 target groups. ... View more

I'm confused. First you say you "want is just to keep the string until "@" appear", then you say you "want to replace every character right to the "@" by nothing". In my world, replace before @ by nothing means keep everything after @. If you want to have both before and after the @, then rex both. ... View more

Why not use Schedule PDF for Delivery? ... View more

Why don't you rex everything after the @? rex field=SWEMethod "^@(? .*)" ... View more

If you have made no changes to your index retention policy, then you should have no local/index.conf files with policy settings. If you do have local/index.conf files, they should not contain DEFAULT settings. Here is some info on index.conf settings: http://wiki.splunk.com/Deploy:BucketRotationAndRetention ... View more

What are the permissions on the hot buckets? ... View more

Those permissions seem a bit restrictive. Are they the same on the searchable and non-searchable buckets? ... View more

How long have you waited? I've seen splunk get itself out of this sequence. ... View more

You can also run a check on your buckets. splunk stop splunk fsck --all splunk start Here are the details on "splunk fsck" http://wiki.splunk.com/Community:PostCrashFsckRepair ... View more

You know, the buckets are named 'earliesttimestamp_latesttimestamp_uniquenumber', and the times are epoch times. Convert one or two of the non-searchable ones: http://www.epochconverter.com/ ... View more

I think the pool warning you were seeing was basically a notification that you exceeded you license limit the day before, and that there may be a problem you need to correct. ... View more

Let me see if I have this straight. 1) You can see the searchable and non-searchable buckets in the Same index/database. 2) When you search that index/database you only see events since the restart? ... View more

Can you post the search? ... View more

You win the splunk did something weird award. I'm gonna have to think about that one. ... View more

How long have you waited? I've seen splunk get itself out of this sequence. ... View more

Have you tried the transaction function? You would need a number unique to the transaction that is repeated for each item ordered. If orderid was that field, then you could search for all items with something like this: somesearch | transaction orderid | search orderid=value You can find the transaction documentation here: http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Transaction ... View more

Kristian is right. Splunk cannot manage buckets on an event by event basis. You can use an epoch time converter to check the timestamps on your buckets: www.epochconverter.com/ ... View more

Oracle and timestamps can be somewhat frustrating. 1) You need to use to_char in your query to convert the timestamp (see the link) 2) The timestamp column should be first in your query (see the link) 3) You may need to add the output.timestamp.parse.format= in your inputs.conf. I did not, but this fellow did (see the link). 4) This oracle timestamp format works for me: inputs.conf yyyy-MMM-dd HH:mm:ss.SSS, props.conf %Y-%b-%d %H:%M:%S.%3N http://splunk-base.splunk.com/answers/71485/splunk-db-connect-timestamp-not-working ... View more

So, you're not getting data from either unix (not passing through the heavy forwarder, or from windows? ... View more