Hi. I would like to make a bar chart, where date/time is on the X-axis, and the resource is the Y-axis, the bar should start at _time, and have a length of duration. Is this possible using only base Splunk 6.1, or is it necessary to download and install additional apps? If it is possible what would the chart look like? Thanks in advance. ... View more

Hi. I have a form, with an entry field, and a timepicker in simple XML. If for some reason, I want to do the search again, without changing either the input field, nor the time, the search button is inactive, and pressing it, does not perform the search again. The for is as follows: Search jobhistorik <!-- define master search template, with replacement tokens delimited with $. This is an example, replace with your own search.--> <!-- the default is a text box, with no seed value; if user does not input a value, then the $from$ token in searchTemplate will be removed --> * Last 24 hours <!-- output the results as a 50 row events view --> index=tws_jobhistorik sourcetype="TWS_event_log" (eventNumber=101 OR eventNumber=102 OR eventNumber=104 OR eventNumber=107 OR eventNumber=111 OR eventNumber=115 OR eventNumber=123 OR eventNumber=151 OR eventNumber=154 OR eventNumber=157) submitName=$job$ | dedup _raw | sort -_time, sourcetype | table _time jobStreamID jobStatus submitName eventText returncode Results true 50 /app/TWS_eventviewer/show_jobhistorik?form.jobStreamID=$row.jobStreamID$&form.jobStatus=$row.jobStatus$&form.submitName=$row.submitName$&earliest=$earliest$&latest=$latest$ Anybody have a clue, as to why? Thanks in advance. Kind regards las ... View more

Hello. I would really like to see what issues there is currently with splunk, and if there is an estimated fix. I can look at the release notes, where there are a known issues, and what is fixed, but there might arise bugs, in a release, after the release notes are published. This list does not need to be public, but might be in the support portal, or another splunk site, where logon is needed. Kind regards las ... View more

Hello. I would like to setup a secondary deployment server, and have found some hints and tips and the manual, it might be me, just not reading it correctly, but I seem kind of stuck. I would like to set it up the following way. Primary DS - All apps to be distributed - serverclass.conf, that includes the secondary DS, so all apps will be copied to this server in deployment-apps. Now this serverclass.conf also includes the distribution to the Universal forwarders, so I only have one copy that gets edited, and deployed to all the other servers. This means, as far as I can see, that all the distibuting apps must land in deployment-apps on the secondary DS, but the app that contains the serverclass.conf, must land in apps, and be used as a "normal" app on the secondary DS, while at the same time be an app on the primary. Just one last thing, I would really like to be able to use a wildcard in serverclass.conf, so I won't have to manually write all the apps in the stanza [serverclass:< class name >:app:< app name >] Thanks in advance. las ... View more

Hello. I have around 450 universal forwarders connected to one deployment server, all the host are windows, some 2008 others 2003, I have phonehome set to 900 secs. so I should get a phonecall around 4 times an hour. I made an app, that is destined for all the servers, after about 22 hours my app is still not distributed to around 90 servers. The process has not stopped, so the number goes down very slowly, but the app gets distributed still. My Universal forwarders are 5.0.1, and my deployment server is 5.0.4. Is it normal with such large latency in the deployment process? Kind regards las ... View more

Hi. I have an application that runs once a day, just past midnight, and produces a file 20130628_000000_agent_statistics.csv, now since the file is produced at the 29th of June the modtime is 29. ‎juni ‎2013, ‏‎00:25:02. Therefore when indexing this file, setting DATETIME_CONFIG = NONE is not an option, as it will revert to modtime. Is the only option to get this type of file indexed right, to mess with datetime.xml, or are there other possibilities? Kind regards las ... View more

Hi. I have been unable to find the time the deployment server uses to evict clients that it haven't heard from. I would like to increase the phoneHomeIntervalInSecs to more than 60 secs. but it seems to have the undesired side effect, that I'm unable to reliable see the deployment-clients in the Deployment server class status. Is there a way to configure a longer keep time for the Deployment server class status? Kind regards. las ... View more

Hi. I have a problem with the configuration of alert - send email with a pdf as attachment. I use Splunk 5.0.1 on windows. I had it working this morning, but then I tried to remove the Splunk search from normal alerts, without PDF. I have tried to restore action_alerts.conf and sendemail.py. My problem is that instead of attaching a PDF, it attaches a CSV file. I have done some debugging on the sendemail.py, and it does receive sendpdf=false. if I force it programaticaly to true, I get a PDF, so I don't think it's the python script. My saved search has the following stanzas: [License_monitor] action.email = 1 action.email.format = pdf action.email.sendresults = 1 If I call sendemail from a search, I also get a csv file instead of a PDF: |sendemail to=name@company.com subject="Something" sendresults=true server=mailserver.company.com format=text inline=false sendpdf=true. I obviously have made an error somwhere, but I can't find it again. Kind regards ... View more

I admit I have used limited time on this app so far but a quick question anyway. When I have multiple failed logins from an IP, is it possible to get the usernames, that where used for these attempted logins? ... View more