Try this [general_default] default_namespace = launcher appOrder = search default_earliest_time = -48h default_latest_time = now ... View more

Try this: [general_default] default_namespace = launcher appOrder = search default_earliest_time = -48h default_latest_time = now ... View more

indexes-extended data is updated periodically. Usage details The default update period is 10 minutes, as defined by the collectionPeriodInSecs attribute in the $SPLUNK_HOME/etc/apps/introspection_generator_addon/default/server.conf file. ... View more

Does your search host="irprapppvot*" PV-API-Key is required and was not provided or is invalid OR pvo.common.20002 yields at least one result always? ... View more

Did you use limit=0 argument. limit Syntax: limit= Description: Specify the number of values of to use for each input event. Default: 0, or no limit ... View more

This typically happens when search processes take time to read initial configuration information from disk. Did you check the utilization numbers on your server? Do you have sufficient system resources available? Did splunk start cleanly without any warnings or errors? ... View more

Hi, rawSize: The volume in bytes of the raw data files in each bucket. This value represents the volume before compression and the addition of index files. sizeOnDisk: The size in MB of disk space that the bucket takes up expressed as a floating point number. This value represents the volume of the compressed raw data files and the index files. http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Dbinspect Thanks Strive ... View more

Hi, The value of pass4SymmKey (the secret key) attribute in server.conf should be same across all the Cluster instances. It authenticates the traffic between license master and its slaves, members of the cluster. The splunk's server.conf has clear details about this key. http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/Serverconf And does pass4symmkey simply compliment client-certificate for connection authentication -- The answer is No. ... View more

If you need in stats command.. Here is the text from splunk docs Memory and maximum results In the limits.conf file, the maxresultrows setting in the [searchresults] stanza specifies the maximum number of results to return. The default value is 50,000. Increasing this limit can result in more memory usage. The max_mem_usage_mb setting in the [default] stanza is used to limit how much memory the stats command uses to keep track of information. If the stats command reaches this limit, the command stops adding the requested fields to the search results. You can increase the limit, contingent on the available system memory. If you are using Splunk Cloud and want to change either of these limits, file a Support ticket. ... View more

This post doesn't talk about stats command at all. ... View more

Read the post carefully. They have 50000 rows but they were getting only 42000. As per your comment then wouldn't they be getting all 50000 results. More over the question talks about CSV. In case if the CSV has any unbalanced quotes then the lookup works till that point and fails after that. ... View more

We faced similar issue. The summarized data forwarding to indexers works fine. Other internal logs forwarding to indexers work fine. But, the Alert Action Log event alone fails. For this to work -- We have to define index in Search Head as well. Note: the data wont be stored on Search Head, eventually the Alert Action's Log event will be forwarded to indexer. But the definition on SH is must. Not sure if it is a bug in Splunk or it is working as expected. I have added a comment in Alert documentation and a discussion is on with splunk folks 🙂 ... View more

If you are going to continue maintaining the local directory in your app then fine. If the solution is going to be taking out local fully and maintaining only default in the app, then it makes sense once to test without including excludeFromUpdate ... View more

If the path is going to be till directory level then that should be ok. By the way putting things under default directory alone was not sufficient? ... View more

Splunk puts its configurations under default directory and we are advised to add our configs under local directory. If you have created a splunk app for aiding custom dashboard creation, then you should put your configurations under /default directory. That way when you provide further upgrades to the app, the end user created dashboards will stay unaffected. Adding excludeFromUpdate is not the solution. This may stop you from providing updates to the app that you have created. ... View more

If you just need license usage per index for last 30 days.. index=_internal source=license_usage.log type=Usage earliest=-30d@d latest=-0d@d | timechart span=1d sum(b) AS volume_b by idx | foreach * [eval <>=round('<>'/1024/1024/1024, 3)] ... View more

Check this https://answers.splunk.com/answers/42814/decimal-how-to-use-vs.html Also, its worth checking fieldformat command. It wont change underlying value hence it is good for charting purposes. https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Fieldformat ... View more

I answered this question but my answer is not seen. In the activity tracker it says this question was answered by me but its missing.. Answering again Hi Keerthana, Yes, you can use deployment server to push baseline apps to the search head cluster members. Whether you need a dedicated deployer depends on your Distributed Deployment Architecture. Suppose if there are going to be runtime updates to the baseline apps then it is good to go with a deployer. Read more here -- http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/PropagateSHCconfigurationchanges#App_configurations While having a deployer has got its own benefits, it should be absolutely fine to not have one when your architecture and functioning of your application needs just a deployment server. One draw back of deployer is: The configuration bundle must contain all previously pushed apps, as well as any new ones. If you delete an app from the bundle, the next time you push the bundle, the app will get deleted from the cluster members. If there wont be any runtime updates to your baseline apps then i think you can ignore deployer. Note: Instead of deploying one more node and making it a deployer, you can make your deployment server to play the role of deployer. Thanks, Strive ... View more