You should search the _internal index for any reference to the log file name in question. Some issues I have seen in the field are: thruput set to low (forwarder is not able to consume the log before it rolls), permissions issues (splunk doesn't have read access to the log file.) What is the version of Splunk forwarder in question? ... View more

You could delete the local account to make the AD account active. ... View more

The method should not have changed between version 6 and version 4: http://answers.splunk.com/answers/28134/rename-an-index-in-4-1-8.html ... View more

You could try filtering further before your dedup to reduce the size of the initial dataset: sourcetype=IIS Page=* | dedup JSESSIONID | etc. Also, a year's worth of data is a lot of data. You might want to consider summary indexing to get faster reporting if this is a search that is run regularly. ... View more

Where is this "Tagger" app? ... View more

YES. Your description is not clear but using a transaction should work if the column value is really the same. Basically: <your search> | transaction <your_column_name> ... View more

I've been asking this question for years and no one has come forward. After a lot of testing there are several settings -- in different config files -- which will affect how long the search artifact will be stored. I figured some of these out by documenting the behavior and checking all the default settings in Splunk. Here are some of the settings I have played with and use: alert_actions.conf [email] ttl = 120 [rss] ttl = 2p [summary_search] ttl = 120 savedsearches.conf [default] dispatch.ttl = 2p alert.expires = 2m alert.severity = 2 limits.conf: [search] ttl = 300 default_save_ttl = 172800 # if user clicks to save search it is stored for 1 week remote_ttl = 300 ... View more

What is the purpose of (?s) The regex did not work for me when I used it. Works fine without it (for me). ... View more

http://answers.splunk.com/answers/44245/regex-match-on-multiple-conditions-help.html ... View more

http://answers.splunk.com/answers/44245/regex-match-on-multiple-conditions-help.html ... View more

What is the reason for this and where is the documentation that explains the issue? ... View more

I've seen this issue before where there are too many invents within a subsecond timespan for Splunk to process. Newer versions of Splunk know this and actually increment the timestamp at indexing to prevent this from happening. Yes, you could increase the max_rawsize_perchunk (Splunk recommended that we set this to a really high value , or unlimited, but it caused browser issues for us). You should also look into that data to see why there are so many events being returned within the same sub second. It could be a bad timestamping issue or lack of timestamp in your event causing Splunk to have to use the current time as the timestamp. ... View more

Format allows the search to bypass some limits due to larger result sets. I use it as a habit just in case. You could try the search without it to see if it still works. ... View more

Yes. You could put the link in the Email Subject. ... View more

Yes, that worked martin. Thank you! ... View more

I got "Misconfigured view '_test' - layoutPanel is not defined for module HiddenSearch. " AND, the view would not load (produced an error and no UI). ... View more