smykb, can you please mark the answer as accepted? thanks 🙂 ... View more

what about apps i've downloaded from splunkbase that weren't originally included with Splunk? ... View more

this is something you can look up in your IIS documentation. ... View more

what dwaddle says will totally work, but this is a simpler method: http://www.splunk.com/base/Documentation/latest/Admin/Tunetimestampextractionforbetterindexingperformance#Disable_timestamp_determination just turn off the timestamping and Splunk will just use the modtime of the file. ... View more

as of now, only the search endpoints of the Splunk REST API are officially supported for development against Splunk. these are documented at http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch however, you can look at all the endpoints that are available by accessing this url: https://:8089/services ... View more

channeling Nick here: "apparently if you set isSticky="False", it just means that it will no longer remember changes to the value. however it will happily continue sticking to the previously set value. so you'll have to set isSticky=False, and then find all the various places in various viewstate.conf files where different users have set different sticky values and delete them all. which if there's more than a few users is somewhat prohibitive." i've filed a bug. ... View more

we are aware of this issue; it's a problem on Safari Mobile. not sure when we'll be able to resolve it, but it's in the queue. ... View more

did you forget to paste in your script? ... View more

snowmizer is the best! ... View more

yes, the first option dwaddle suggests does work, but it's important to understand that changes you make to the login.html will be overwritten every time you upgrade, so you'll have to make a copy of your edited login page and re-add it after every upgrade. it is also not guaranteed that the design of the login page html won't change, so you should make sure to check it out, especially after a major release upgrade (for instance to 4.2 when it comes out next year). ... View more

i am told that attaching funny (SFW!) pictures is a great way to get your ER looked at quickly 🙂 ... View more

re: 1. there is a validated process documented here: http://www.splunk.com/base/Documentation/latest/Admin/Moveanindex :) ... View more

here is a related, very useful question/answer: http://answers.splunk.com/questions/6369/halp-my-nix-deployment-server-is-propagating-corrupted-configuration-files-to-m ... View more

here is a related question/answer: http://answers.splunk.com/questions/5731/line-endings-in-an-apps-config-files ... View more

hexx is the best!!! ❤️ ... View more

there are worse things to have on the brain... 🙂 ... View more

this might also be useful. it's not 'raw' syslog, but you can forward the data in syslog format: http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems ... View more

a brief Googling session yielded this: https://kc.mcafee.com/corporate/index?page=content&id=KB61298&cat=CORP_SIDEWINDER&actp=LIST which suggests that there is an 'export' script that you could use. i suggest you review the documentation for Sidewinder to see if there are any other ways to get the logs out of it. the best option is probably to find out where Sidewinder writes its logs and point Splunk at that location using the information in http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories ... View more