I'd do this with an eventtype - craft a search that matches the bug in question and then save it with a name indicating the bug number. It's the most flexible way to do this. As an additional bonus, you can define a workflow action to link to your bug database, assuming it's web based and you can construct a URL from the bug number. (Or indeed, in a dashboard customize drilldown to go to the bug database) ... View more

The standard way to label data in Splunk is to use the sourcetype field, with a sourcetype setting in your monitor stanza: [monitor:///var/log/glassfish] sourcetype=glassfish source , sourcetype and host are all fields that can be tagged like any other in Splunk You can customise the dashboard by editing the XML for the dashboard_live to change the summary page. For example, you could replace the search with a query using the rest command to get a list of tags, like so : | rest /services/saved/tags count=0 | search field_name_value=host* | rename tag_name as tag | fields tag . I'm not sure that I'd recommend this though. You can't delete sources or sourcetypes as these are metadata about the indexed events. However you can alias sourcetypes to a new name. ... View more

You could build a custom search command to do this. If you do, please put in up on Splunkbase. ... View more

I've not used Ironport in a while, but when I last did this you could add additional log subscriptions, and that's how I added the data to Splunk. How are you configuring the mail logs to reach Splunk? ... View more

Updated! Thanks @sdvorak_splunk ... View more

For a 10K disk, the expected aproximate range would be 166.67 to 90.9 IOPS For a 15K disk, aproximately 210 IOPS ... View more

A likely default will be of the form : CN=cp_mgmt,O=org..a12bc3 ... View more

I think you have a TCP input rather than a receiving port. Remove the TCP input on your splunk server and add a receiving port as per http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver ... View more

My suggestion would be to write a script against the SDK to do this. Check out the docs on access and roles http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTaccess ... View more

Example apps with new visualisations: Multidimensional Search which uses D3 The Splunk App for VMWare has an example treeview control, although I'm not aware of any usage documentation The Javascript SDK has an example using the Rickshaw charting library built on D3 Hope these help! ... View more

Does this work: | chart count(eval(searchmatch("*_date=\"invalid\""))) AS "Invalid Date Syntax" ... View more

How are you testing this? The command needs to be able to get data from Splunk's API and expects to be called by Splunk which will pass in credentials. This doc runs through the options for enabling debug logging: http://docs.splunk.com/Documentation/OPSEC-LEA/latest/Install/Enabledebugging ... View more

Are your forwarders where your data resides? Typically you would put a forwarder on the system where the data resides and then use that forward data to your splunk indexer(s). If it is, this should http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories help you out. ... View more