A slow dispatch.remoteTimeline finish means that splunk is taking a long time to fetch the per-bucket events or the logfiles related to the search -- both of which happen at the end. Fast mode searches do not even event buckets, so if this happens in fast mode as well, it is probably the log retrieval. This answers post mentions how the two behaviors can be disabled if they are a problem in your environment: http://answers.splunk.com/answers/122950/dispatch-finalizeremotetimeline-taking-a-long-time.html However I believe this particular painpoint was reduced by mid 6.1.x in any event, and the log fetching is greatly helpful in troubleshooting. The choice is yours. ... View more

This error (usually!) comes from the way we store the search history on a per-user basis. We use a csv-storage component that does not handle the case of multiple updaters at the same time. When running many searches, it's possible to have overlapping updates to the per-user history csv file. The result is that the component that tries to help complete your searches with searchers that you have run recently in the drop-down box below the search bar will not have complete information. That is the only repercussion. Thus this message is usually completely ignorable. It was made somewhat less noisy in 6.x some version. If you are on 5.x it is more noisy. If you have other errors surrounding this message then there may be something worth investigating. ... View more

This functionality does not exist out-of-the-box in the basic splunk tool. If you run a search over a larger timerange in the flashtimeline, you can browse around within the results. If you want to rerun the search with a different timerange based on custom user interaction, then linu1988 has already given you a better suggestion. ... View more

This wasn't an answer to the question, so I moved to a comment. However, it's really an independent question. I tried reopening it as such, but it didn't work. I suggest you do the following: Open a new question In the question, be clear about the goal you are trying to achieve -- anonymize data prior to indexing it sounds like? Show an example of what your data looks like, not necessarily the log text, but something like it with the important values replaced with replacement text Show the configuration that you are using to handle it in full ... View more

This is really a feature request. There is no answer other than that it currently does not. Sideview is great stuff. Please use various tools they produce. Sideview makes a lot of high quality things that you can use or buy to use with Splunk. In the last few years, the main focus has been on UI customization that does not require XML editing. I have no opinion on what the balance should be here, but you are asking about a different area than that focus. Suggesting to add a higher quality XML editor to main Splunk is a good enhancement request which you should probably report via support. (I do not say this to waste your time. I say this because it's our current channel for reporting enhancement requests, and it's how customer interest is quantified.) ... View more

Symbolic links cannot cause splunk to index files twice, unless you make use of crcSalt to force splunk to consider files different via their filenames. Monitoring both the symbolic link and the target of the link is not a good practice however. You will get uncertain behavior as to which name splunk finds the data under. ... View more

You are correct. That functionality isn't available, but with the model provided it wouldn't really help you. Time based lookups effectively create blocks of time between each time-key in the table. Basically for any particular time that we wish to lookup in the table, we find the expressed window of time (from the time key field) that matches the lookup time, and find the entry at the leading edge of the window. You could certainly look up multiple fields against one time window set individually by multiple lookup passes, if the desired enrichments by field are the same values by time window, or if you can simply acquire different target values out of the lookup by your choice of lookup use expression. However there is only one time key that will will lookup at once. If it were to express multiple time columns in one lookup file, you would still have to do the manual work to compute the intersections of all the possible valid time-point transitions in order to contruct the set of valid windows. So it wouldn't really save you much over just having three lookups once for each type of date, that you use to acquire any fields relevant to those times, and then use the outputs to lookup any values that are dependent upon the combination in another table. ... View more

Splunk does not have a feature to modify the value of _raw (the text of the event) at search time in a way that users cannot ever get access to the original value. You could try to, for convenience cases, create a calculated field _raw that replaces the original _raw, but that won't prevent users from being able to get the original value of _raw by doing things like overriding your rule. If you need to anonymize data that users will see, you need to put an anonymized version of the data in an index they have access to, and not give them access to an index containing the non-anonymized data. Avoiding putting it in ANY index would do the job, as would putting it in an index that their role is not permitted access to. In order to anonymize data at input time, you can use a traditional regex transform or a SEDCMD. If you want to create an anonymized version of the data at a later point, you can try to get summary indexing to do this for you -- producing modified data to go into an alternate index -- but it's somewhat fragile and I don't recommend it. ... View more

I'd suggest editing this to describe your specific goal. Documenting the fail seems more like a thing for jira. ... View more

It's valid criticism, but it will be more effective if delivered as an ER for the core type of functionality you want/need. (I'm not sure the 5.x implementation was even optimal. I think this comes down to rapid access to a large number of visually categorized and organized searches? Just a guess.) In addition, you can also provide an expression of the pain associated with the loss of this functionality via sales. ... View more

syslog-udp cannot transport 1500 character events, beause that exceeds ethernet MTU, and syslog-over-udp is a single packet. The data is likely being truncated before splunk receives it. Consider a more reliable transport, such as syslog over tcp or splunk forwarders. ... View more

The default timestamp behavior for Splunk is to guess the times and assume that they generally go forwards, because it was designed for logfile handling. For data that jumps back 13 years, you may have to set a TIME_FORMAT for the data, and you have have to adjust MAX_DAYS_AGO as well as the MAX_DIFF_SECS_AGO / MAX_DIFF_SECS_HENCE. DAYS_AGO puts a bound on the expected difference betwen file modtime and the timestamps, DIFF_SECS puts a bound on how far timestamps are expected to jump from event to event. Start with a TIME_FORMAT though. ... View more

Good eyes. That means my answer is wrong. We do have this feature, for realtime searches specifically, when you would tend to want it. At least the documentation clearly states that it does what you want. I have not tried it. ... View more

I think it's fair to say that the goal of the app was not to have a 6-8GB powershell process. I think you should determine whether this powershell process is associated with the app (what are its args etc) and work with support to further define the problem. ... View more

The reason is to avoid having that data in the index twice. The mechanism is as already stated. Please do not adjust the mechanism, it will make you sad. ... View more

A search using a lookup based on a csv file will use only the form that exists at the start of the execution of the search. (If the search was to change the lookup definition mid-search, typically customers would get incoherent output from a search.) You could, if you need to update the lookup dynamically, work around this by using a scripted lookup. ... View more

Scheduled searches & reports is clearly listed as a feature not available with Free. Why embedded reports might not work is an open question. ... View more

We believe that Splunk monitor uses on the order of 1KB per file or directory in a monitored location. This includes files that will not be read. ... View more

This is might unusual. The system's own logfiles are having seekpointer mismatches. This suggests something unpleasant, like two splunks fighting over one set of logfile dirs, sysadmins manually modifying the logfiles, a choice to manually modify (eg rotate) splunk logfiles outside of splunk, or problems in the filesystem the data is stored on. ... View more

This is a current limitation in the Splunk UI. ... View more