yeah that was the trick,,,,After the + hours the span=5 minutes is added, so thats why within the hour the results are 1/5 off ( just use 1 minute) ... View more

I setted it to 410 and now it is working,,,NOT sure if there is a limit... .appLogo { height: 43px; width: 410px; padding-right: 5px; float: left; background: url(images/appLogo2.png) no-repeat 0 0; _background: url(images/appLogo.gif) no-repeat 0 0; } ... View more

Glad i reckon its not my misconfiguring! Thanks nick ... View more

this works like a charm! ... View more

So i presume you changed some settings according the manual? Can you post your config here? ... View more

You really have to play this ball though sales,,,so contact splunk u.s. that your local splunkcontact/partner didnt deliver your answers. ESS is pack of knowledge with services/education etc, and there are plenty of resources outthere. But again, those are guided by an accountmanager. ... View more

Take a look at this , you have to configure this per index. So e.g. in indexes.conf [main] frozenTimePeriodInSecs = 7776000 This wil delete data from the main index after 90 days (so its in seconds) Regarding the delete on demand, you can clean per index as in : splunk clean evendata -index "indexname" ( splunk has to stopped) ... View more

just a brainwave, if you set an alert on the lic violation and fire of a script that set indexes.conf, restart splunk action? ... View more

This sounds like a mod request? ( to use regex) ... View more

Oke digged into it,,,the suspected searches are within an app and are owned by nobody...so after changing something its owned by the user,,, So whats best prtatice then? ..change it in the app and modified the permissions initialy before using? ... View more

Here's another thing, isn't my sourcetype override happening at index time and my field extractions happening at search time? : yeah thats what i think,,,btw why the KV_MODE=none setting ?? ... View more

Are the extracts not working at all? I ran into some troubles as well with one big syslogfeed on udp so now i use a sysloghost with a forwarder (rolled files monitor) and push this as one sourcetype to the indexer (splunksyslog). There i use exact the same method as you are using ( making 8+ sourcetype overrides) and have dozens of fields extracts on those new ones. So I am not sure if this is working only for cooked data,,,my concern was the load ( 50G a day,so wanted a store and forward before parsing) I def. want to test your setup cause I have some planned deployments with this as well! ... View more

Oke just wanted to make sure,,,( I hoped that you could also extracted a unique id and use this with a specific search/transaction) so lets say that I cut the user part, and only index that one to indexB, and reconstruct this with searches over indexa en indexb on _time and "someid" ... View more

It seems that the settings for importRoles in authorize.conf are leading,,,so settings for a inheritance role arent picked up! importRoles = power;user srchIndexesAllowed = ;_ srchIndexesDefault = main;os srchFilter = * srchTimeWin = 0 srchDiskQuota = 10000 srchJobsQuota = 50 rtSrchJobsQuota = 100 so when i add a roll which is deriving from power and choose index=test as allowed i ended up with main;os ... View more

Oke thanks, I am aware it isnt easy, this is just a general question, and the 3 searches are an example to decribe the functional fundamentals. Bottemline is I have seperate searches which are running in notification if there is a (siem) hit, those are combis of eval, subsearches, lookups etc. So just wondered if i can run a top just like evettypes top. On the dashboards i have per search, postprocesses, with linkswitches, intentions to drills etc etc.. I will diginto this later but appreantly its more complex then i was thinking ( just though i could group "search" results and simple count them.... ... View more

Stange that this one is devoted...the search hit is an alert and differs per alert (fi external lookup for fields which are allowed, or users who are logged into a system with non allowed name etc etc... So if there is a search hit then its an alert....now i want a consolidated overview instread of a bunch of loose rangemap values. ... View more

<view template="dashboard.html"> <label>Development</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="LinkSwitcher" layoutPanel="panel_row1_col1"> <param name="mode">independent</param> <param name="label"> </param> <module name="NullModule" group="Operations Overview" autoRun="True"> <module name="HiddenSavedSearch"> <param name="savedSearch">dev_eventcount</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">CPU seconds</param> <param name="secondaryAxisTitle.text">Pipeline processors</param> <param name="legend.placement">right</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">300px</param> </module> </module> </module> <module name="HiddenSavedSearch"> <param name="savedSearch">dev_eventcount</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">CPU seconds</param> <param name="secondaryAxisTitle.text">Pipeline processors</param> <param name="legend.placement">right</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">300px</param> </module> </module> </module> <module name="TimeRangePicker"> group="Operations Overview choose time" autoRun="True"> <param name="searchWhenChanged">True</param> <param name="selected">All time</param> <module name="HiddenSavedSearch"> <param name="useHistory">false</param> <param name="savedSearch">ferrydev_eventcount</param> <module name="ResultsHeader"> <param name="entityName">scanned</param> <param name="entityLabel">events scanned</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Events over choosen timeinterval</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> </module> </module> </module> </module> </view> So I ended up with a single switch with everything under it,,,cant manage to get this right,,,any tips? ... View more