Hi, I created a dashboard panel. Whatever name i specify, the name changes automatically to all lower case letters and words separated by a underscore. We use REST API, to fetch the custom dashboard panels and display it on our custom GUI. During this time its confusing to end users as letters are converted to lowercase. I assume, splunk does this automatically to follow some naming conventions. Is it some standard way to create view xml's. Thanks Strive ... View more

Hi, We have a requirement to show data in bucketed format. Avg Data Delivered Count < 50 MB 3450 < 100 MB 200 < 250 MB 350 < 500 MB 1000 < 1 GB 120 > 1 GB 55 The problem we are facing is: Since the data gets sorted as string, 100 MB appears first and then 50 MB.. and so on... How to render the results as mentioned in example above. Basically i would like to disable default sorting. One option i thought is to use python scripts. Format the data in script and then render it on screen. I would like to know if there is an option in splunk query itself. Thanks Strive ... View more

Hi, In the home page of our application, a combo box is populated with results from a splunk search. At times, the combo box does not load, and an error is displayed below the combo box. The error is: This SearchLister module could not retrieve its results. A 500 error was returned with the following text "error". After seeing the error if i go to search page and try executing a search, i get an error. The error is: [IDX] Streamed search execute failed because: Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK. If i login to Job scheduler node and check, license information. It shows everything is valid. The errors wont disappear until i restart the JS node. (Power off and then Power on the Virtual Machine). Why these errors are displayed. We use shared splunk enterprise license for our development environment. Thanks Strive ... View more

Hi, We have deployed Job Scheduler, Indexer, Search Head and Forwarder on Virtual Machines. Often we see issues like: 1. Indexer is down. Unable to distribute to peer. 2. Crash logs in indexer. 3. Splunk stops running in Job Scheduler node. 4. Many processes of Splunk helpers running(PIDs increase drastically to 15 and then fluctuate between 5 to 10). Earlier we did not have all these issues. Recently we see that network is slow and sometimes it is unresponsive for couple of minutes (It takes more than a minute to establish connection to VM). What kind of issues may arise in splunk system due to slow nature of network. Whether the issues that i have mentioned are due to network speed being slow. Thanks Strive. ... View more