I'm trying to update the max_concurrent instances on my scheduled search from the default of 1 to 2. But the REST command doesn't appear to be working. curl -k -u admin:changeme https://splunk:8089/servicesNS/admin/search/saved/searches/test_search -d 'max_concurrent=2' -d sharing=app (Note: the url is correct) Can someone spot the issue in my curl command? ... View more

Looking for clarification. I have users without scheduling capability who ask me to schedule their saved search. I can go through the motions and set these (as the admin user), save my changes, however the scheduled search actually never runs because the user doesn't have the capability to schedule. What is the point of allowing me to configure these settings if the user doesn't have the capability? And what does setting Run as "owner" vs "user" do? My original guess was that the search can be scheduled to run as the user who was scheduling it (me) but clearly that would be too convenient.... ... View more

A method previously used with SH Pooling no longer seems to work for search heads in a search head cluster. In the documentation, for changing object ownership, it advises changing the owner of the object, but does not indicate how to do it: http://docs.splunk.com/Documentation/Splunk/6.2.5/Security/BestpracticeforremovinganLDAPuser > 3. For any searches or objects that the user owns, change the owner. You > change it an admin user or maintenance > account, or whatever you prefer. (The grammar is also incorrect 🙂 ... View more

I have a form that uses a searchTemplate and postProcess. The form is so that the user can select the time range for the base query. When I change the time range using the drop down, my postProcess panels are not being updated. What am I don't wrong? <form> <label>Sample Dashboard</label> <description>USES POSTPROCESS</description> <fieldset submitButton="true" autoRun="false"> <input type="time" token="earliest" searchWhenChanged="true"> <label>Select Timerange</label> <default> <earliest>-1h</earliest> <latest>now</latest> </default> </input> </fieldset> <searchTemplate>index=summary search_name="Summary Test" | stats sum(total) as total sum(bytes) as bytes by city,state</searchTemplate> <earliest>$earliest.earliest$</earliest> <latest>$earliest.latest$</latest> <row> <panel> <table> <title>bytes by city,state</title> <searchPostProcess>search state=CA | stats sum(bytes) as bytes by city </searchPostProcess> <earliest>$earliest.earliest$</earliest> <latest>$earliest.latest$</latest> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more

I'm using a CIDR lookup table against raw data (find a match in the entire event, any field.) It won't work, understandably with CIDR notation as my lookup. Is there a command that can be used to expand the CIDR notation into all possible IP combinations? ... View more