I want to replace the * character in a string with the replace command. How do I apply the * by escaping it, not to replace the whole string? ... View more

I want to put a set of checkboxes on a dashboard, and display panels according to the checked checkboxes. I have 3 panels, with an attribute. I want to create one single checkbox input element, with three checkboxes, like: Display... [] panel1 [] panel2 [] panel3 And display each panel respectively. My problem is that a checkbox input element can have only 1 token, but I want to have a separate token for every checkbox option. So basically, I want to set a separate token for every choice element in the checkbox panel. ... View more

My data consists of pairs of files, lets call them file_A_1...file_A_n, and file_B_1...file_B_n, where file_A_1 is connected with file_B_1. The pairs are always ingested at the same time together. The first step I need in my datamodel is to join the corresponding pairs, like source=file_A_1 join type=outer myIDField [ search source=file_B_1 ]. How can I achieve this dynamically, with every pair of file? ... View more

Users within my environment, who have the Power user role in Splunk, can't access the results of the alert, they are getting "The view you requested could not be found." error message all the time. They have the "schedule_search" capability which I believe is the needed on for this. No matter, they try to open the link from the alert email, or from the web gui from the triggered alerts list. Edit: I checked in the audit.log, the only capability the user was denied is the "edit_user". I granted this capability to the user's role, but still can't see the alert, however, the denied-lines disappeared from the log. ... View more

After upgrading my Splunk cluster to 6.3.1, I'm facing "500 Internal Server Error" all the time, after logging in to any of my Splunk instances (search head, deployment server ...) My splunkd.log is full with lines like this: WARN HttpListener - Can't handle request for /services/broker/connect/<peer id>, max thread limit for REST HTTP server is 2729, threads already in use is 2729 My web_service.log ends with things like this when the issue happens: 2015-11-30 08:21:49,790 DEBUG [565c071d9a4b27ac7a58] cplogging:55 - [30/Nov/2015:08:21:49] HTTP Traceback (most recent call last): File "E:\Splunk\Python-2.7\Lib\site-packages\cherrypy_cprequest.py", line 606, in respond cherrypy.response.body = self.handler() File "E:\Splunk\Python-2.7\Lib\site-packages\cherrypy_cpdispatch.py", line 25, in __call_ return self.callable(*self.args, **self.kwargs) File "<string>", line 1, in <lambda> File "E:\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 38, in rundecs return fn(*a, **kw) File "<string>", line 1, in <lambda> File "E:\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 118, in check return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "E:\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 167, in validate_ip return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "E:\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 246, in preform_sso_check update_session_user(sessionKey, remote_user) File "E:\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 189, in update_session_user en = splunk.entity.getEntity('authentication/users', user, sessionKey=sessionKey) File "E:\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 249, in getEntity serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "E:\Splunk\Python-2.7\Lib\site-packages\splunk\rest_init_.py", line 567, in simpleRequest raise splunk.RESTException, (serverResponse.status, serverResponse.messages) RESTException: [HTTP 503] General server error ... View more

I want to present results from my search in a dashboard. I don't want to make the search itself visible, just assing values from it to tokens, ad present them with my javascript. My search will calculate some statistics, so I wan't to have values from it, like e.g. mysearch.count, mysearch.sum. What's the easiest way to achieve this ? ... View more

I checked that sample app in the docs, but HTML dashboards are used in that guide. Can I use that accordion with a Simple XML dashboard? ... View more

I'm facing an issue with a monitor input like this: index=myindex disabled=0 sourcetype=mysourcetype crcSalt=salt The problem is, it only reads the first file in that folder. I've tried several times changing the crcSalt, and re-read the folder, the first file gets read every time ,but just the first, nothing else. I've tried adding different files to the folder, and removed the original ones, but the issue still persists. In the log, I see lines like these for the other files: ERROR TailingProcessor - File will not be read, seekptr checksum did not match Last time we saw this initcrc, filename was different. ... View more

I have a monitor input, which rarely has new files, and I'd like set up an alert for it. How can I find something about when a file has been finished reading in ? ... View more

I create a statistics table, which is sorted, and I use head 10 at the end, to display my results. What I want to do is, to add a new column with a number value, to show the position of the event. something like this: col1, col2, col3, position <---- thats what I want to add value, value, value, 1 value, value, value, 2 value, value, value, 3 value, value, value, 4 How can I achieve this ? ... View more

Little strange issue I got... I ingest files into an index. I want to add a yes/no field to my events, based on if the same event is present in a previous file. Lets say, I have events with fields likes this: keyfield1, keyfield2, miscfield1 ... miscfieldN And I want to do something likes this: index=myindex source=inputfile1 | eval flag=if([index=myindex source=inputfile2 keyfield1=<value of keyfield1 in the event> AND keyfield2=<value of keyfield2 in the event>],"true","false") I know the syntax of the if statement is not true, but hope it can articulate my problem. ... View more

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Pivot#Filter_element According to this, there is a regex comparator usable with Filter. I can't find any example, how should I use it. What I've tried: | pivot [...] Filter fieldname regex ".*" But I get the following error: Error in 'PivotProcessor': Error in 'PivotUtil': Cannot filter using 'regex' on field type 'string' How can I apply a regex-filter to my pivot? ... View more

So I created an app with a custom navbar. I added the dashboard.css and application.css to the app, and works fine for all the elements in my navbar. The problem is, if I choose the "basic" item from the navbar, like Search, Pivot, Dashboards, .. etc, the CSS is not applied, and the design is reverted to the default splunk design. How can I fix this ? ... View more

My idea was to put a custom css file in the /etc/users/username/search/appserver/static. Can I do this somewhow ? ... View more