See this previous answer. You can use the delete command to remove that specific data from the index so you'll no longer see it. http://answers.splunk.com/answers/71540/removing-data-from-splunk-by-host ... View more

There is an example in the Splunk 6 Dashboard Examples App but it doesn't use the Google Maps app. It is more difficult to do in Splunk 5 so I suggest using Splunk 6. http://apps.splunk.com/app/1603/ Look at Examples -> Layout Examples -> Image Overlay with Single Values. You'll need to provide the app image and then you can add your markers on that image. ... View more

You'll need to upgrade from 4.2.2 to 4.3 first and then from 4.3 to version 6. They are both pretty straightforward. The docs have all the details. http://docs.splunk.com/Documentation/Splunk/6.0/Installation/HowtoupgradeSplunk ... View more

It might help to provide more information and context to your issue. Reading a couple of the docs should help you. There are several reasons that you may not be seeing a field. Your user might not have the permissions, there might not be a configuration to extract the field at search time etc... You could always add a field using the interactive field extractor (here). http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Addfieldsatsearchtime There are also several places to look for configuration files: http://docs.splunk.com/Documentation/Splunk/6.0/admin/Wheretofindtheconfigurationfiles ... View more

The Splunk App for Windows is not compatible with Splunk 6 so you will get errors. It is currently being worked on and there will be a Spunk 6 compatible version released on apps.splunk.com in the next couple of weeks. You'll see on the App page that the Splunk versions for compatibility are listed. ... View more

It is possible that you you can connect to Vertica using their JDBC driver, you'll just need to add that driver. Check out the docs online and let us know if you run into any challenges. Splunk tests and supports connecting to the following databases: DB2 Microsoft SQL Server MySQL Oracle Database Sybase, Adaptive Server Enterprise version 15.7 Developer's Edition Also, although unsupported, you can connect to the following databases out-of-the-box: Generic ODBC support H2 HyperSQL PostgreSQL SQLite ... View more

So you tried this: host=host2 OR host=host1 OR host=otherhost* | rex field=host "(?<fruit>d{4})" | fields fruit host | stats distinct_count(host) as myCount by fruit | sort -myCount and then you could add where myCount < 3 or | search myCount < 3 ... View more

This is certainly possible to do in Splunk and much easier now that Splunk 6 has been released since you can just use native HTML. You"ll see an example in the Splunk 6 Dashboard Examples app. (Layout Elements -> Image Overlay With Single Values) http://apps.splunk.com/app/1603/?elq=9bb5463a0c9047bd87a56326391ce0e8&elqCampaignId=911 From Nick: Splunk 6 makes this a lot easier to do within Simple XML, where you can include custom css on a per-page level The basics are as such: - Create all of your dashboard elements that you want to overlay in simple xml (set an "id" for each element; new to Splunk 6) - Use row grouping for the above so that a single "panel" gets rendered - Include a custom css in your simple xml view - Use css to set absolute positions for each element (by id) ... View more