You need to set line breaking property in your props.conf http://docs.splunk.com/Documentation/Splunk/6.2.5/Admin/propsconf LINE_BREAKER = <regular expression> * Specifies a regex that determines how the raw text stream is broken into initial events, ... View more

did you consider scaling your architecture? adding more search heads, indexers? You will have to give more details on your architecture and what you are trying to achieve for the forum to help you better. ... View more

What is your search for license usage? ... View more

Look at the below answer http://answers.splunk.com/answers/290023/what-is-the-best-way-to-move-a-saved-search-from-o.html#answer-289227 ... View more

What have you tried so far? Look at this documentation which explains with examples http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Join ... View more

Works only with admin capabilities. More information in the below post. http://answers.splunk.com/answers/189732/splunk-support-for-active-directory-why-are-non-ad.html ... View more

you will have to rename indentity as userid in your sub search index=abclogs | stats count by userid | eval userid=lower(userid) | fields userid NOT [|inputlookup totalname.csv | eval identity=lower(identity) | rename identity as userid | table userid] ... View more

You don't have to format it. Column position does not matter. ... View more

... | rex (?m) reportReferenceNumber\W\s\W\s(?P<REPORT_REFERENCE_NUMBER>.\d+)\W | search REPORT_REFERENCE_NUMBER = 0 You can extract the number into a field and filter on it ... View more

Right, I meant specific to knowledge objects. The same documentation has this The cluster does not replicate any configuration changes that you make manually, such as direct edits to configuration files. For example, if a user creates a saved search in Splunk Web on a cluster member, the cluster replicates that saved search to all cluster members. However, if you, as the administrator, add a saved search by directly editing the savedsearches.conf file on one cluster member, the cluster does not replicate that saved search to the other cluster members. You must use the deployer to push that saved search to all cluster members. ... View more

You should not make changes on the member directly using CLI. Either you should do it via Web on the member or through the deployer http://docs.splunk.com/Documentation/Splunk/6.2.5/DistSearch/HowconfigurationworksinSHC ... View more

Since you said yours is a corporate account, are you tied with any entitlement? if so, your Splunk relationship manager should be able to help you. ... View more

did you try searching under users tab (top right on this page) with some keywords that you might think are part of your user name? ... View more

how does _time look in the above table? you can bucket the events into a specific time range before you do stats . This way all events within that time period are grouped together. Example below which groups all the events in a 5 min window .. | bucket _time span=5m | stats.. ... View more

You will have to add another field to dedup to retrieve the unqiue combination of the results.. May be | dedup month Customer ... View more

Do you have the month field already extracted? In that case doing dedup on the month should retain only the last available event for each month. ..| dedup month ... View more

You can control what app the user lands on up on login by configuring user-prefs.conf http://docs.splunk.com/Documentation/Splunk/6.2.4/Admin/User-prefsconf default_namespace = <app_name> ... View more

Concatenation operator between two strings in splunk is . and not + index=cashflow host=atm source=income OR source=outcome | eval accountStatus="Income: ".transactionIncome." and Outcome: ".transactionOutcome | table accountStatus ... View more

How is it different from what you are seeing as event details? Is it because you are getting the results from multiple sources for your search? If so, add a filter on the source field for which you would like to see the results. ... View more