What are you trying to accomplish with your custom search command? That may help us get you what you need. ... View more

Here are the steps for taking your python script and creating a splunk search command. http://docs.splunk.com/Documentation/Splunk/latest/developer/searchscripts Some examples referenced here for you to look at as well: http://blogs.splunk.com/2011/11/30/using-custom-search-commands-with-splunk-python-sdk/ ... View more

Is it a one time need to re-index the file or is it going to continually monitor it? I assume your 'app' index has other data and therefore we can't just clean the index and re-index the file? ... View more

It's going to set the source based on the regex you provide. ... View more

You use roles to lock down access to indexes. IE you could create a role with access to only one index. Then you are able to give individual users that role. That means that if they come into the search app and try to search on other indexes, they will get nothing. At the app level you assign roles that can access an application. Hope this helps. ... View more

If you do a field extraction on the values, you'll be able to search how you want. This should work for you. Place this in a props.conf file (create one if it doesn't exist) in your 'SPLUNK_HOME\etc\apps\users\(username)\local' directory. EXTRACT-UPS1_temp = (?i) UPS2\s\S+\s(?P [^ ]+) EXTRACT-UPS2_temp = (?i) UPS2\s\S+\s(?P [^ ]+) Then you can do a search like this ... | where UPS1_temp > 29. You can also extract out the Warm, Cold values and use those as well. Here's the docs on extracting new fields http://docs.splunk.com/Documentation/Splunk/latest/User/ExtractNewFields ... View more

Did you go through this below. It has the details that you need to create a lookup. http://docs.splunk.com/Documentation/Splunk/4.3.2/User/Fieldlookupstutorial http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources ... View more

You can put in comments underneath the answers rather than creating a new answer. You create the app, which is only going to have views and dashboards on your index. Then you will create a user role that only has access to that index and give those users access to your app as well. ... View more

In inputs.conf you'll define the index you want for all of your inputs. In indexex.conf you will define where the index is stored. [yourindex] homePath = $SPLUNK_DB/yourindex/db coldPath = $SPLUNK_DB/yourindex/colddb thawedPath = $SPLUNK_DB/yourindex/thaweddb maxTotalDataSizeMB = 10000 Then in all of your app searches and reports they will reference your index (start with index=yourindex). There is no way to assign an index to an app that i am aware of similar to how you can assign indexes to roles. ... View more

So any one of the screens that you navigate to are really Views. A Dashboard, a Form search and Advanced XML page are all views. But we might not consider a basic form page, where you do some searching, a dashboard. Just in terms of what you call it. Make sense? ... View more

Navigate to Manager - Data Inputs - UDP. If you look at 'More Settings' for that entry, is the radio button checked for DNS or is it set at IP? Try that and restart, sounds like you may have tried this in the config file already but just in case. ... View more

Use the Deployment Monitor app and you'll find a dashboard with details that should help. You may just need to enable it in your current deployment. Go to Manager -> Apps and see if it's already in your list. Enable and restart. Otherwise download it from Splunkbase. http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor ... View more

Just use the tail command. You could also sort it in ascending order to see those with greatest idle time at the top. ... | tail 10 http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/tail ... View more

Once you have the calculated the value you want for CPU, in this case idle CPU you just pipe it to time chart and use avg() by host. Is this what you are looking for? ... | timechart span=1m avg(idleCPU) by host ... View more

Yes it will still work. I think the only view you won't be able to use will be the map under the Client Behavior menu that shows where we are displaying clients IP access. Should be the last menu item. ... View more

What are you looking to accomplish with a 'today' time range for real time. Maybe that will help us answer your question. ... View more

Change it to be sourcetype="firewall" | lookup geoip clientip | rename clientip AS client_ip. When you put the 'AS' in there it does not work but you can still rename the field. You should now see the fields under field discovery like client_city, Client_country etc...that you can now use. ... View more