Yes, they will run in sequence. The order is determined by the lexicographic order, so that LOOKUP-a will run before LOOKUP-b. ... View more

You can certainly create a simple lookup to map the country to the continent. I suppose you might have to create one that takes cit into account, if you need to distinguish between countries that span more than one continent. ... View more

You can simply use the eval command's case() function, e.g., ... | eval case(0<=myfield<8,0, 8<=myfield<15, 8, 15<=myfield<100, 15, 100<=myfield,100) ... View more

first of all, it should be unnecessary to sort by _time . transaction does expect events in reverse time order, then arranges them in forward time order within the transaction. second, you need to specify the fields you want in the mvlist parameter to the transaction command. Otherwise, they will be deduplicated and sorted lexicographically. If you have null values, you should also specify the nullstr parameter to set a placeholder value. ... View more

There is no one optimal relationship. The answer depends on the searches you are running, and the relative amount of work that can be divided between the indexers and the search head by Splunk's map-reduce framework. For example, if you run ... | stats count , almost all the work is done on the indexers, and so you can have a single search head serve many more indexers. In contrast, something like a complex ... | transaction startswith=... command will require more from the search head. If you use Verbose Mode in the timeline view, you will do things that rely more on the search head, while Fast Mode does fewer of these things. ... View more

Signal 9 is a KILL signal from an external process. It is likely that your OS has some kind of monitor or other setting on it that kills processes that do certain things. Perhaps your administrator is watching for memory usage, access to certain files, or other things. You should consult with your system admin to find out what they have put in place. ... View more

Yes, overlapping inputs.conf entries work from 4.2 on. ... View more

Also, Splunk raises the ulimit to the hard limit max, so the soft limit doesn't matter. To raise the hard limit, you need root. ... View more

First of all, if these are not 'fixed' how are they going to be set? Scripted alerts are launched by an instance of a Splunk saved search. Where would the instance of the search get these varying parameters? Generally, you can have parameters that are fixed (simply by wrapping them in simple script, for example) or that vary by the saved search definition (by either using alert_actions.conf or by performing logic in the wrapper script), or you can have instance-specific actions by having your script use the documented parameters or the results file. ... View more

In general I would recommend using the JDBC drivers with DB connect. In any case, even if you use the ODBC bridge, you would have to install and configure a Teradata-specific ODBC driver on your machine for the JDBC-ODBC bridge to talk to, so I would not consider this any less effort. ... View more

You can create new SSL certs using the $SPLUNK_HOME/bin/splunk createssl command. Run $SPLUNK_HOME/bin/splunk help createssl for the parameters, and make sure you back up your old certificates first. ... View more

That is what you would normally do with any search, even just a hardcoded search string, though I suppose you could run those with exec_mode of blocking or oneshot . If that's what you want to do, you can just get the search string for the saved search and dispatch a job using that string in the desired exec_mode . ... View more

You can submit a enhancement request by submitting a case here https://www.splunk.com/page/submit_issue and setting it to priority level P4. ... View more

you can either set the default value to "*", or you can have the input/dropdown use a prefix to the field value. if there is no field value selected at all, then the prefix will also be omitted, so the term will not even exist in your search template. ... View more

Using Flash may make a difference, depending on your browser. You haven't said what browser you are using, but there is a significant difference between a new version of Chrome or Safari and an older version of IE. As a very last resort, you may have to create simpler views, or in the extreme, use the Splunk REST API to create a drastically simplified UI by querying and rendering the results on the server. ... View more

If you want to run a search, you must also specify the view in which it is run, assuming you want to link to it and run it in the UI. ( If you want to just schedule and run in the background without UI, you can use the REST call http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch ) Generally, this URL looks like http://splunkweb:8000/en-US/app/search/flashtimeline?s=test ... View more

This will set the timestamp to the time the file is indexed, rather than the modification time of the file. ... View more

You can do this force this by creating a datetime.xml file containing only: <timePatterns /> <dataPatterns /> and then indexing with DATETIME_CONFIG = /etc/apps/myapp/local/mydatetime.xml or whatever the appropriate relative path to your file is. This will cause date parsing from the data and from the file name to fail (because no patterns exist that can be matched), until the remaining option is to use the modification date of the input file. Instead of trying to modify the epoch date when the data is indexed, you should just convert it at search time when viewing the data, e.g., using the | convert search command or strptime() eval function. ... View more

No. The fields that exist are determined dynamically depending on the data, and so can not be determined without looking at sufficient data from that sourcetype. There is no way without looking at every piece of data to know with 100% certainty that you have seen all possible fields. ... View more