I have licensing stuff being displayed using Advanced Charting. I would like to have the default for this display have the Formatting Options minimized. I have searched through the docs and can find how I might set this. Can someone point me where I might find more info on how to do this? I have even searched on things like ChartTypeFormatter and haven't found the info I am looking for. My viewstates.conf has: [charting:h4id68dp] AxisScaleFormatter_0_12_0.default = "" ChartTitleFormatter_0_9_0.default = License by Sourcetype ChartTypeFormatter_0_7_0.default = line JSChart_0_7_1.height = 300px LegendFormatter_0_13_0.default = right LineMarkerFormatter_0_10_0.default = false NullValueFormatter_0_12_0.default = gaps SplitModeFormatter_0_11_0.default = false StackModeFormatter_0_10_0.default = default YAxisRangeMaximumFormatter_0_11_0.default = "" YAxisRangeMinimumFormatter_0_10_0.default = "" YAxisTitleFormatter_0_9_2.default = Indexed Log data (GB) ... View more

I have a search: index=_internal host=licenseManager type=Usage earliest=-5d st!=splunk_metrics | rename st AS sourcetype | timechart span=1d sum(eval(b/1024/1024/1024)) AS GB by sourcetype | addtotals This gives me a nice table over the past 5 days on license usage per sourcetype. I also get the total usage so I have some idea on our total license usage. This search takes a while to run. I would like to have a summary index that runs once a day so that I can generate a report once a day that looks back lets say the past 30 days. For the scheduled search I have: index=_internal host=licenseManager type=Usage earliest=-2d@d latest=-1d@d st!=splunk_metrics | rename st AS sourcetype | stats sum(eval(b/1024/1024/1024)) AS GB Scheduled to run at 1am. alert condition = always add fields: index = summary report = License_Usage_Report Is this the correct way to set it up? How do I generate the report using the summary index? (we are running Splunk 4.2.5 in case this matters) Thanks for any help. ... View more

I would like to suppress all messages in the search app. It would be nice to be able to suppress then by role so that Admins see the messages but Users don't. Any suggestions on how to do this? Currently we are using Splunk 4.2.5. ... View more

We have restricted access to Splunk via the REST API. We have created a user where we think we have allowed this capability. Trying the command: curl -k https://splunkserver:8089/services/auth/login -d username=restuser -d password=password Get a message that login fails. The user restuser inherits from the user role and restaccess role. authorize.conf contains: [role_restaccess] importRoles = user rtSrchJobsQuota = 0 srchIndexesAllowed = *;_* srchIndexesDefault = *;main srchJobsQuota = 4 srchMaxTime = 0 rest\_properties\_get = enabled rest\_apps\_view = enabled ~~~~~~ Any suggestions? ... View more

We are trying to optimize the performance of our Splunk environment. How does Splunk handle the following: A scheduled search is scheduled to run every minute. It takes 20 minutes for the scheduled search to complete. Do 19 other searches get queued? Does Splunk ignore any additional runs of the search until the current search completes? Does Splunk not reschedule the next search until the current one completes? I figure the person should inspect the search and then schedule it based on how long it takes to run. We are addressing that. Thanks, Randy ... View more