Splunkd runs over SSL by default, so any communication will also be SSL. This isn't something you could disable just for that function as it would require splunkd to bind to another port. Instead in server.conf you could disable SSL for Splunkd communication. This is probably a bad idea and personally in this case I would suggest that running this setup over a WAN isn't a great idea if you want to improve performance. http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Serverconf Other ways to spin it could be to setup local indexers and have the data forwarded over the WAN between them, not ideal and not the cheapest method but.. it could possibly improve performance at the expense of the speed at which data becomes available to search. ... View more

Well, another way you could spin this is to do something like; | stats max(metric) as MAX, avg(metric) as AVG And then stick your where/filter after that ... View more

to run most splunk bin commands you need to use something like ./splunk cmd btprobe etc. ... View more

If only there was some sort of awesome resource out there that helped with questions like this... Oh wait, there is! http://dev.splunk.com/view/javascript-sdk/SP-CAAAECM There are some great examples on there for integrating, you could also use a number of the other SDKs to achieve the same goal but the JavaScript one is the best for building web apps ... View more

The issue here is that Splunk creates a cache of all XML files which is what it is loading when you view a dashboard. If you edit XML directly or drop a new file in it won't re read that until you force it to reload its cache. In the current version I believe clicking on the app logo in the top left will cause it to re-read, alternatively you can also hit; http://SERVERURL:8000/en-US/debug/refresh?entity=/admin/views Which will force a refresh. Finally you can use a python script with the SDK that Splunk packages along with the build of Python to refresh the cache programatically. I don't have the code to hand at the moment but let me know if this is what you're after and I'll dig it out. EDIT: So what you could do is write a python script that checks for certain files or if the count of files in a directory changes - you can find great examples of this on Stackoverflow.com. To enable this you can then call this script on a regular interval in inputs.conf and pass it an admin session key like so; [script://$SPLUNK_HOME\etc\apps\APPNAME\bin\SCRIPTNAME.py] disabled = false interval = 15 passAuth = admin In the script you then can use; import splunk.rest sessionKey = sys.stdin.read().strip() splunk.rest.simpleRequest("/servicesNS/nobody/APPNAME/data/ui/views/_reload", sessionKey = sessionKey) But obviously you can build some logic around that. ... View more