Good point and/or request. I've just sent a note to splunkbase admin requesting app removal. ... View more

There are several ways to accomplish this. First, there is an out of box Alerts console that may provide a solution or inspire a customization. The fired alerts REST endpoint can provide information too. Example of querying that endpoint using Splunk search language: | rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count Audit.log is another place from which you can derive information. Sample entry of fired alert: 03-04-2014 00:20:01.515 -0500 INFO AuditLogger - Audit:[timestamp=03-04-2014 00:20:01.515, user=admin, action=alert_fired, ss_user="admin", ss_app="search", ss_name="test", sid="scheduler__admin__search__test_at_1393910400_4278", alert_actions="", severity=2, trigger_time=1393910401, expiration=1393996801, digest_mode=1, triggered_alerts=1][n/a] ... View more

5) remove delete capability (through UI or CLI) to prevent unauthorized or accidental deletions ... View more

2) review what we're going to delete | inputlookup delete_these.csv 3) enable delete capability (through UI or CLI) 4) perform delete by searching against original data and eliminating things we want to keep (search for only items we want to delete using our list of unique event identifiers) and pipe that list to the delete command. Hint, try it without delete command first! index=* sourcetype=dupes | eval delete_id=_cd."|".index."|".splunk_server | search [|inputlookup delete_these.csv | fields delete_id | format "(" "(" "OR" ")" "OR" ")"] | delete ... View more

1) mark for delete note that we create a tuple that uniquely identifies the event with eval id=... we then group duplicate events with transaction command and throw away the last one ...because we want to keep one of the events finally, we record the ones we've marked for deletion in a csv file index=* sourcetype=dupes | eval id=_cd."|".index."|".splunk_server | transaction _raw maxspan=1s keepevicted=true mvlist=t | search eventcount>1 | eval delete_id=mvindex(id, 1, -1) | stats c by delete_id | outputlookup delete_these.csv ... View more

d and watsm10 have it right. We must first build a list of events to delete and separately delete them. This is for a few reasons. A) We want to verify what we're going to delete first B) We can't delete after non-streaming command (such as transforms) So we want to take these high level steps: 1) mark for delete 2) review what we're going to delete 3) enable delete capability 4) delete 5) remove delete capability ... View more

I've seen timeouts when SSO is in play. If you're using SSO or have otherwise modified your root_endpoint, you'll need to adjust the URL to include your custom root endpoint. ... View more

./splunk cmd btool --debug deploymentclient list will show which settings are coming from which file. But like The Highlander, "there can be only one" deployment server. ... View more

If deploymentclient.conf is in $SPLUNK_HOME/etc/system/local/, that will trump any settings in $SPLUNK_HOME/etc/apps/deployment_client_app/ A Splunk instance cannot talk to two deployment servers at once. Allegedly. ... View more

Can you paste the results of ./splunk cmd btool --debug deploymentclient list (You can change your actual host names to "serverA" and "serverB" before sending) ... View more

As you know, there are several locations we can place configuration files. Splunk merges them at run time using a specific set of instructions based on file precedence to resolve conflicts (to determine the "winning" setting if it occurs in 2 or more files). The tool you used (btool) show the result of this merging as it exists on disk (NB: In some cases, when files on disk are changed, but Splunk has not been restarted, btool will show one thing while Splunk is using something else). The --debug flag is useful for showing from*where* the winning setting came. ./splunk cmd btool --debug deploymentclient list It is also worth noting that files in default directories should never be edited, instead, copy the settings which are different to the local directory and modify those settings (they will "win" over default, per configuration file precedence. Since deploymentclient is applied at the global context, this should be the order of operations for resolving conflicts. 1. System local directory -- highest priority 2. App local directories 3. App default directories 4. System default directory -- lowest priority If you have everything in order per the above, and btool confirms that, you may just need to restart? ... View more

This will not work with real time searches as there are not artifacts that may be fetched by loadjob for an RT search. ... View more

This is also referenced in the install guide: http://docs.splunk.com/Documentation/OPSEC-LEA/2.0.3/Install/Systemrequirements#Linux ... View more

There are several ways to get this result. One method is to filter relevant actions 'inline' using an eval within stats ... | stats count(user) as user_count sum(eval(case(action="A",1,action="B",1,action="C",1,1=1,0))) as filtered_action_count ...the above method creates a value of "1" for any event with an action of A, B, or C and then adds those together in a field called filtered_action count. Completing the example, to calculate the percentage, we can use another eval: ... | stats count(user) as user_count sum(eval(case(action="A",1,action="B",1,action="C",1,1=1,0))) as filtered_action_count | eval percentage= round(filtered_action_count/user_count),2) ... View more

6.0 update from http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers 6.0 forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 6.0 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer. 6.0 indexers are backwards compatible with forwarders down to 4.x. The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher: * Dynamic file headers * Timezone extraction on the forwarder ... View more

Thanks Dimitri. And Dimitri. ... View more

This was just added to the rest command's example section: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest#Examples ... View more

There are many ways to do this using license master, querying Splunk's API, introspecting the license file itself, and more! Here is one example of invoking the rest command to return license types & when they expire: | rest /services/licenser/licenses | eval expiry=strftime(expiration_time,"%b %d, %Y") | table type expiry ... View more

reading your original question again, you may actually want this search (replacing count with values) --> sourcetype=A OR sourcetype=B | eval status{sourcetype}=status | stats values(status*) by clientip uri_path ... View more