Martin: It was that simple. I just was missing the quotes in the submacro. In the main macro: earliest= parseDayForEarliest("2013-03-13") parseDayForEarliest(1) strftime(strptime("$day$","%Y-%m-%d"),"%m/%d/%Y:%H:%M:%S") eval-based defintion on. Regards, Jens ... View more

Hi, thanks for the answer and the correction for the strptime. Your solution might work, but I disagree that i need to do it like this. eval-based-defintion macros can be used here. Its just that i have problems to return the output as string. Tests are working fine with simple things, but not with strptime. Regards, Jens ... View more

Thanks! That does it 🙂 ... View more

Hi, thats look very promising, but where would I have to put that snipped? Jens ... View more

Hi, We had also "zombie" searches. In our case it were searches still running on the indexer, but not anymore on the Search-Head. This occurs in Splunk 4.3.x with KV_MODE=XML and logs with invalid XML. If you have such problems, ask Splunk for the Patch-Release. Regards, Jens ... View more

Hello, what the SPL number for this? Kind Regards, Jens ... View more

# CheckHttpHost.ini # # rewrite based on the HTTP_HOST used in the request. # # remember to rename this file to IsapiRewrite4.ini , # or copy this content to a file named IsapiRewrite4.ini # before using it! # # Mon, 25 Sep 2006 15:42 # RewriteEngine ON UrlDecoding OFF ProxyTimeouts - - - 0 StatusUrl /iirfStatus RewriteLog c:\temp\iirfLog.out RewriteLogLevel 1 CondSubstringBackrefFlag * RewriteCond %{REMOTE_USER} ^$ RewriteCond %{CERT_SUBJECT} ^DC.*\((.*)\)$ [NC] RewriteHeader REMOTE_USER: ^$ *1 # # Direct SSO to Indexers (Optional) # RewriteCond %{HTTP_HOST} ^logview-(indexer_.*)\.csintra\.net$ [I] ProxyPass /(.*) http://*1.domain.net:8000/$1 # # SSO to local Search-Head ProxyPass /(.*) http://localhost:8000/$1 # Searcher ProxyPassReverse / http://localhost/ # Indexer ET ProxyPassReverse / http://indexer_dev.domain.net/ # Indexer IT ProxyPassReverse / http://indexer_it1.domain.net/ ProxyPassReverse / http://indexer_it1.domain.net/ # Indexer UAT ProxyPassReverse / http://indexer_uat1.domain.net/ ProxyPassReverse / http://indexer_uat2.domain.net/ # ..... ... View more

Our Splunk Server is in our internal company intranet. So its trusted by default. Using another browser is not an option, as we're not allowed to so. (I work in a swiss bank). ... View more

Message: Expected identifier, string or number Line: 1534 Char: 69 Code: 0 URI: https://XXXXXX/en-US/modules/@105575.1/modules-f1ddb9ebc2c6a79fec0e78f87856f259.min.js Message: 'Splunk.Module' is null or not an object Line: 1083 Char: 5 Code: 0 URI: https://YYYYY/en-US/app/search/flashtimeline_excel Message: 'Splunk.Module.loadParams' is null or not an object Line: 1103 Char: 13 Code: 0 URI: https://ZZZZZZ/en-US/app/search/flashtimeline_excel ... View more

Hi, actually your addon does not work at all in our environment. Webpage error details User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; MS-RTC LM 8; InfoPath.3) Timestamp: Tue, 7 Feb 2012 18:21:35 UTC ... View more

Thats what i would like to do, but thats not working. -- Jens ... View more

Hi, we're using Ionics Isapi Rewrite Filter (http://iirf.codeplex.com/) on W2K3 and IIS 6. Works fine and its free. If someone is interested ... Jens ... View more

Hi, so you say the configurations are not merged? And settings from App1 are not applied to App2? Jens ... View more

Hi MW, i found that code, but i must be blind and can not find the file which contains ".aboutPopupContainer". Can you give me the filename? Jens ... View more