before installing/upgrading other apps on your 6.0 Splunk deployment, i recommend ensuring that they are supported for 6.0. the http://apps.splunk.com/app/668/ JMX app does not currently show that 6.0 is supported. ... View more

i have added the tag for this app, which means the author should be notified of this post. i recommend you also use the 'contact the author' link on the app page: http://apps.splunk.com/app/300/ one thing to note is that this app is not listed as working with Splunk v. 6, just 5.x and earlier. ... View more

this assumes you are using a version of splunk older than 6.0. if you're using 6.0, the same procedure applies, but all the changes should be made in a local copy of inputs.conf see http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorWindowsregistrydata#Filter_incoming_Registry_events ... View more

a change was made in 5.0.5 and later versions to improve security and prevent clickjacking issues, this is what you're running into. to implement this change, we set X-FRAME-OPTIONS=SAMEORIGIN in the header for all cherrypy served pages. this means that you can only iframe in pages coming from the same site. we added a new web.conf setting: x_frame_options_sameorigin = [True | False] which defaults to True. if you set this to False, your iframing will work again. ... View more

a change was made in 5.0.5 and later versions to improve security and prevent clickjacking issues, this is what you're running into. to implement this change, we set X-FRAME-OPTIONS=SAMEORIGIN in the header for all cherrypy served pages. this means that you can only iframe in pages coming from the same site. we added a new web.conf setting: x_frame_options_sameorigin = [True | False] which defaults to True. if you set this to False, your iframing will work again. ... View more

nwieseler, if Drainy answered your question, could you please check the checkmark to accept his answer? thanks 🙂 ... View more

you mean, besides this? http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Extractfieldsfromfileheadersatindextime#Example as the topic mentions, CHECK_FOR_HEADER has been deprecated in 5.x, but it does work. ... View more

you can't open the files yourself, but you can use the tsidxprobe tool to have Splunk review them for you. check out: http://docs.splunk.com/Documentation/Splunk/5.0.3/Troubleshooting/CommandlinetoolsforusewithSupport#tsidxprobe for more info. ... View more

i'm not going to be able to find out, this question was asked on behalf of another user. but thank you 🙂 ... View more

i've tagged your question with the tag for the app i think you're talking about. this will notify the app's owner of your question. ... View more

i added the twitter for splunk app tag; this should notify the author of the app of your question. ... View more

you need to provide the actual search, like so: ./splunk add saved-search -search ' ' -name 'TEST' -schedule ... View more

jj: if glitch's answer solved your problem, please accept his answer by checking the checkbox. thanks! ... View more

you can however use the 'dedup' command when searching if you actually have to index the events twice. ... View more

yeah, i had chosen to make the saved search public to users of my app's context, but when i created the macros, they were private by default. this is kind of lame, since there's no way to set the permissions of a given macro in the "add new macro" page while you're making it. however, you can change these from the Manager » Advanced search » Search macros list page. ... View more

great idea. we have the same issues with the big Splunk monitor displays at corporate HQ. ... View more

historyコマンドは、検索履歴を示し http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/History ごめんなさい、私の日本語は下手です！ 🙂 ... View more

Splunk licenses do not randomly expire. if you're experiencing issues with your license, you should definitely file a case with Splunk Support. this is how licensing works: http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/HowSplunklicensingworks this is how license violations specifically work: http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Aboutlicenseviolations "Violations occur when you exceed the maximum indexing volume allowed for your license. If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more warnings on an Enterprise license or 3 warnings on a Free license in a rolling 30-day period, you are in violation of your license and search will be disabled for the offending pool(s) only -- other pools will remain searchable and be unaffected. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply a temporary reset license (available for Enterprise only). To obtain a reset license, contact your sales rep." if you're getting locked out of search because you're violating your license, you should be seeing warning messages before this happens. ... View more

inb4--oh dammit. ... View more

Rakesh, we've asked our partner sales team to help you out, please respond to the email you've received to let them know how they can assist you. ... View more

there's a chapter in the Distributed Deployment Manual about how Splunk uses different types of resources, here's the topic about search performance: http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Accommodatemanysimultaneoussearches ... View more