Well I understood the first part, it may not point out the error but it offers a workaround. The second part, what? ... View more

What now? If you're saying theres no support you just need to give it time, its a community site so it sometimes takes a while to get an answer ... View more

All you need to do is ensure they're enclosed within speech marks, e.g. "GigabitEthernet1/0/1",Server1 "GigabitEthernet1/0/2",Server2 ... View more

Its certainly possible. All you need is to select the date/time, parse it into a readable format and pass it downstream into your other modules. ... View more

It means that you have a search peer (configured in Manager -> Distributed Search) which has the same servername as the search head you're on. Pretty self explanatory 🙂 The usual culprit for these is when you are running two splunk instances on the same box for dev or testing, in this case Splunk will use the server host as its servername by default, you can override this in server.conf in $SPLUNK_HOME/etc/system/local/ by setting a value called servername as per the docs; [general] serverName = <ascii string> * The name used to identify this Splunk instance for features such as distributed search. * Defaults to <hostname>-<user running splunk>. * May not be an empty string * May contain environment variables * After any environment variables have been expanded, the server name (if not an IPv6 address) can only contain letters, numbers, underscores, dots, and dashes; and it must start with a letter, number, or an underscore. E.g. in server.conf in SPLUNK_HOME/etc/system/local/ [general] serverName = bobServ Of course this is just the usual suspect, it could be another instance on another box which happens to have the same servername, perhaps server.conf has been shared and both servers have the same name or something else altogether 🙂 ... View more

Your config looks wrong to me, from the docs; NO_BINARY_CHECK = [true|false] * When set to true, Splunk processes binary files. * Can only be used on the basis of [<sourcetype>], or [source::<source>], not [host::<host>]. * Defaults to false (binary files are ignored). At the moment you have it configured to ignore binary files ... View more

I'm not suggesting you aren't, but when you schedule a savedsearch are you allowing a few minutes for each search? e.g. each one runs -13m@m to -3m@m, instead of -10m to now? ... View more

I know I've said this many times but I'll say it once more, you need to post code! You've obviously not got a search firing or passing its results down somewhere along the way. ... View more

In your case, you might find paying for professional services to be useful ... View more

The summary page only displays data in the main index by default, so it won't register detail on other indexes. Related: http://splunk-base.splunk.com/answers/47879/cannot-see-data-that-gets-indexed-on-summary-page ... View more

I'd disagree slightly on the other answer, I would say the easiest approach is to take a backup of your indexes, reinstall Splunk and migrate the indexes back across. This way you will regain your search capabilities immediately. Read this for details on how to do the backup; http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Backupindexeddata Of course the rest of the answer remains true, don't index so much 🙂 ... View more

This sounds a lot like bugs, (SPL-57518, SPL-58650) http://docs.splunk.com/Documentation/Splunk/5.0.1/ReleaseNotes/Knownissues Best bet is to get in touch with support ... View more

Right.. and what was the result of splunk status? ... View more

Thats the generic Splunk copyright, have a scroll to the bottom of the page. I believe thats probably the year it came into existence ... View more

How many databases do you access? Another solution could be to have multiple versions of the db connect app installed but renamed for their different purposes. Of course this is a bit of a hack, plus it would break any automatic updates. ... View more

Have you tried creating eventtypes or macros to do the same thing? Then you only need to edit them in the manager just the once ... View more

If they have been specifically introduced in v5 then no, the previous version would have no idea if they existed or not. If we're talking Advanced XML then append /modules to the end of your server URL. e.g. hostname:8000/modules to see a list of modules you can use within your instance to check. Also, converttodrilldownsearch was available in 4.3. If you mean the simple xml drilldown funkyness that came along in v5 then no, you won't be in luck. Time to upgrade! ... View more

No you're quite right, I've been working in JS all day and read JavaScript instead of Java ... View more

No. Its maintained and updated there. Another question is why? You can sync with git or just download it from the page, identical to if you were to download it hosted elsewhere. ... View more

What sort of variable do you mean then? If its not time related then no, there isn't really any way to put a value in a file and have it interpreted in the XML. To do this you would use something like the ValueSetter in sideview utils or just type it in for each XML. I'd be more interested to know what use-cases (e.g. what sort of variables) you'd want to share across many dashboards. ... View more

I think you are looking for http://docs.splunk.com/Documentation/Splunk/5.0/admin/Timesconf In this conf you can define your own time periods/ranges to use within Splunk. You define this within $SPLUNK_HOME/etc/apps/APPNAME/local/ ... View more

Well you still have spaces in the from field and I don't know if your email server is on the localhost or not, I also don't know what authentication it requires or the connectivity it has. The error you've pasted is related to the connectivity of the server, not Splunks side. ... View more

Could you give an example of what you are trying to achieve or would like to? ... View more