This is pretty old but, in newer versions of Splunk, you can delegate who a report runs as owner or user. If you select the user option, the job will run as the user thus respecting the quota's for that user and role. If your teams are assigned to different roles, this will enable you to ensure that team a's jobs do not impact team b's. ... View more

From the recent product advisory. Product Advisory: Default root certificates for release 6.2 and prior versions of Splunk Enterprise, Splunk Light and Hunk will expire on July 21, 2016. Failure to replace the expiring default certificates prior to July 21, 2016 will result in the immediate cessation of network traffic for any connection which uses them. So I believe the answer to your question is no. ... View more

This works for me when the token value and label are the same, but of course it does. Would also like to know how to differentiate between the two as I haven't experimented with using the name. I assume it's not possible, The name is simply for aesthetics, I think. ... View more

You cannot achieve a quorum with only two search heads. Add another. ... View more

Find out where it is cheaper for you to host your indexes and then look into distributed search ... View more

Try here ... View more

There are examples in the documentation ... View more

Transaction is your friend. | transaction startswith=neededMessage1 endswith=neededmessage2 | where duration <=5 ... View more

Change disabled=1 > disabled=0 ... View more

Tokens work inside field selectors. I generally like to limit all my selectors by the time range selected so the options are relevant. You should be able to dynamically populate your selection list using a search with tokens from the other selector. ... View more

I'll admit this only compares to the max ... View more

Try this | appendpipe [streamstats range(count) as difference max(count) as max | eval perc=difference/max*100] | search perc>=1 ... View more

admin_all_objects is also required to use a secured SMTP relay for sending dashboard PDF's. I agree this grants way too much access and I've opened enhancement request #352759 to address it. ... View more

Nice one. I didn't think of coalescing until after I posted and I was already heading to bed. ... View more

Try this (sourcetype=ActiveDirectory) OR (sourcetype="WinEventLog:Security" EventCode != 4725 OR EventCode != 4726) | eval x = strptime(lastLogonTimestamp, "%H:%M.%S %p, %a %m/%d/%Y") | where x < (now() - (86400 * 60)) | rename user as sAMAccountName | stats latest(lastLogonTimestamp) as lastLogonTimestamp by sAMAccountName | rename sAMAccountName AS "User" lastLogonTimestamp AS "Last Login" ... View more

I've noticed that 6.4 is much more strict about the serverName key in server.conf. I believe this is the new end-all be-all forwarder name. This became obvious to me in some automation testing using puppet to apply a forwarder upgrade from 6.3.3. Funny thing is this doesn't appear to be documented in http://docs.splunk.com/Documentation/Splunk/6.4.0/Installation/Aboutupgradingto6.4READTHISFIRST ... View more

You could possibly re-write the config using http://docs.splunk.com/Documentation/Splunk/6.4.0/RESTREF/RESTconf and then fire off a debug/refresh. ... View more

Everything behind the scenes is REST. I can't imagine this would be any problem as you're talking to splunkd not the OS. ... View more

Can you post your props config for this input? ... View more

From: http://docs.splunk.com/Documentation/Splunk/6.2.4/AdvancedDev/CustomChartingConfig-FontColorBrushPalette Setting color properties: <option name="charting.foregroundColor">0x000000</option> <option name="charting.backgroundColor">0xFFFFFF</option> <option name="charting.seriesColors">[0x6CB8CA,0xFAC61D,0xD85E3D,0x956E96, 0xF7912C,0x9AC23C,0x998C55,0xDD87B0,0x5479AF,0xE0A93B,0x6B8930,0xA04558, 0xA7D4DF,0xFCDD77,0xE89E8B,0xBFA8C0,0xFABD80,0xC2DA8A,0xC2BA99,0xEBB7D0, 0x98AFCF,0xECCB89,0xA6B883,0xC68F9B,0x416E79,0x967711,0x823825,0x59425A, 0x94571A,0x5C7424,0x5C5433,0x85516A,0x324969,0x866523,0x40521D,0x602935]</option> seriesColors array Uses an array of hexadecimal values to define the colors of chart series (surrounded by brackets and separated by commas, no spaces). See the Define series colors subtopic in the Charting configurations overview for more information. Note: The masterLegend parameter influences series color mappings made with seriesColors. For more information, see Chart colors. If you want to apply static colors to specific fields we suggest you use the fieldColors property (see documentation of the fields color palette, below). ... View more

Indexed extractions may be what you need. From: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Configureindex-timefieldextraction Concatenate field values from event segments at index time This example shows you how an index-time transform can be used to extract separate segments of an event and combine them to create a single field, using the FORMAT option. Let's say you have the following event: 20100126 08:48:49 781 PACKET 078FCFD0 UDP Rcv 127.0.0.0 8226 R Q [0084 A NOERROR] A (4)www(8)google(3)com(0) Now, what you want to do is get (4)www(8)google(3)com(0) extracted as a value of a field named dns_requestor. But you don't want those garbage parentheses and numerals, you just want something that looks like www.google.com. How do you achieve this? transforms.conf You would start by setting up a transform in transforms.conf named dnsRequest: [dnsRequest] REGEX = UDP[^\(]+\(\d\)(\w+)\(\d\)(\w+)\(\d\)(\w+) FORMAT = dns_requestor::$1.$2.$3 This transform defines a custom field named dns_requestor. It uses its REGEX to pull out the three segments of the dns_requestor value. Then it uses FORMAT to order those segments with periods between them, like a proper URL. Note: This method of concatenating event segments into a complete field value is something you can only perform with index-time extractions; search-time extractions have practical restrictions that prevent it. If you find that you must use FORMAT in this manner, you will have to create a new indexed field to do it. props.conf Then, the next step would be to define a field extraction in props.conf that references the dnsRequest transform and applies it to events coming from the server1 source type: [server1] TRANSFORMS-dnsExtract = dnsRequest fields.conf Finally, you would enter the following stanza in fields.conf: [dns_requestor] INDEXED = true Restart Splunk for your configuration file changes to take effect. ... View more