I have a search which runs an eval statement. The problem is every couple of times a day the numbers its pulling (they are incremental numbers) are reset. This of course means the last number received is higher then the first number received in the search and results in a negative value. I want to throw this number out entirely. How do I go about this? Example Problem: eval FOO = firstFOO-lastFOO Where firstFOO=10 and lastFOO is 1024 Foo will now equal -1014 which completely messes up the graphs. Usually this is an incrementing number, but this counter gets reset when the application does. ... View more

Is splunk FIPS 140-2 compliant? ... View more

What is the expected outcome of the "Yesterday" time function when applied to data from multiple timezones. I have a report that brings data back from Berlin, Sydney and Cleveland. I would like to run the report once per day for "Yesterday's" data, but each region will have a slightly different definition of "Yesterday" based on the local timezone. ... View more

Is there a way to specify an alternate location for a Splunk forwarder to do its Splunk crash dumps? ... View more

I have an SSL cert signed by a third-party CA. I point to it in the in the web.conf file (caCertPath=/certs/cert.pem), restart splunkweb and connect via https://server:8000. I can see my cert file is being read, but the connection is untrusted because I haven't installed the intermediate cert file anywhere. HOW/WHERE do I install the intermediate cert? ... View more

Wondering if we can take advantage of this: http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_hardware_acceleration_04.html ... View more

I'd like to see a search that will show me who is logged in currently. Anyone know how to do this? ... View more

What's the best way to create a search to identify which hosts have not sent a syslog message to Splunk in the last 2 days? ... View more

Was wondering if there was a quick way to reload an app in splunk without having to restart the splunk server ... View more

The sendemail.py script seems to want to support the sending of pdfs, but I can't trick it into actually delivering one from the command line. I have tried: sourcetype=syslog startminutesago=5 | sendemail to="[email protected]" sendpdf=1 sendresults=1 pdfview=1 and various other incantations of the same with no luck. The PDF server works fine with dashboards and saved searches. Inside of the email that sendemail.py sends is this statement: An error occurred while generating a PDF of this report: Can't attach PDF - either ssLink or sessionKey unavailable ... View more