Search looks right, if you add print job["sid"] you can get the job id and look it up under activity -> jobs. ... View more

This is basically what I do, never had a speed problem. Dumps the results into a list of json objects. I send this data to a web page for display. service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD ) search_query = "search * | head 10" kwargs_normalsearch = {"exec_mode": "normal", "earliest_time": "-5m@m", "latest_time": "-1m@m"} job = service.jobs.create(search_query, **kwargs_normalsearch) while True: job.refresh() if job["isDone"] == "1": print job["sid"] print job["runDuration"] break resultCount = job["resultCount"] offset = 0 count = 100 data = [] if int(resultCount) > 0: while offset < int(resultCount): kwargs_paginate = {"count": count, "offset": offset} page = job.results(**kwargs_paginate) for result in results.ResultsReader(page): d = {} for r in result: # print r , result[r] d[r] = result[r] data.append(d) offset += count for result in data: print result ... View more

This works for me: while True: job.refresh() if job["isDone"] == "1": print job["eventCount"] break ... View more

Something link this: rex field=_raw "(?https?:\/\/[\da-z.-]+.[a-z.]{2,6}[\/\w .-]*)" ... View more

Try streamstats to set the value of free IPS at the time and use predict to look ahead. ... View more

Getting started with stats, eventstats and streamstats may be what you are looking for. http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/ If that does not help more info will be needed. ... View more

I gather lots of logs from our syslog server recursively and no issues. The host_regex in the inputs.conf helps keeps all the server names in order. If you use log rotation to move logs make sure you have a good whitelist/blacklist strategy. We also had to up the bandwidth the UF uses to keep up with the amount of data in limits.conf http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/inputsconf http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Limitsconf TO keep an eye on things take a look at the SOS and Deployment Monitor apps. https://apps.splunk.com/app/748/ https://apps.splunk.com/app/1294/ ... View more

Yes there is, below is a link to the CLI docs. I use a script to install our UF's and set the basics. The rest of the configs is then downloaded from our delivery server. You can add multiple forward-servers and the UF will round-robin them. http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/SupportedCLIcommands ... View more

add (?ms) on the beginning - the s is dotall, and the m is multi-line. (?ms)java.lang.Exception:\s?<field>(.+) ... View more

Off the top of my head something like this (?i)java.lang.Exception:\s?<field>(.+)$ ... View more

You would run this against your deployment server. curl -k -u admin:pass https://<deliver server>:8089/services/deployment/server/clients There will be multiple entries, each will have a s:key name="hostname", s:key name="wma-app-test2". You'll also get the UUID of the server, as the title, and you can call /services/deployment/server/clients/ to get info about a single machine. ... View more

Yes there is, take a look at http://docs.splunk.com/Documentation/Splunk/6.1.2/RESTAPI/RESTdeploy#deployment.2Fserver.2Fclients I don't use the REST directly, but the SDK's can help, I use the python one almost daily. ... View more

This works: * | head 1 | eval ip = "192.168.0.11" | search ip=192.168.0.1/24 ... View more

Tokens may work for you. You can pass the timeframe the user clicks and perform your search. You can add: row depends="$token$" To prevent the row from showing until the token is present, i.e. user clicks. While this will not do the add/subtract time you get close. I have a similar situation where I want to expand the tie defined by the token, only way I see to do that is with a little JS. This is on my todo list to finalize a current project. http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/tokens ... View more

Something like this to get you started: index = _* sourcetype=audittrail info!=canceled | stats list(info) min(_time) as min max(_time) as max list(total_run_time) list(search) by search_id user You can adjust a bit to get your alert. ... View more

I do this via the command line: splunk set deploy-poll <IP_address/hostname>:<management_port> splunk restart This call gets made by our config management, when we need to make a change. For a new install this cmd is part of the install script. ... View more

Take a look at the transaction cmd. Does the stats work you're trying to do for you. http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/transaction ... View more

Nice! Cant type that much on my tablet. ... View more

You can do this with a transform command. Something like this: [kvpair] REGEX = ([a-z]+)=([a-z]+) FORMAT = $1::$2 Then add to props. [<sourcetypw>] REPORT-syslog =kvpair My syntax may not be 100%, but the docs will help you there. http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/transformsconf ... View more

You can get index time like this eval indextime = _indextime Then compare against _time and create your alert. ... View more

Use fast mode and be explicit about the fields you want. Mode docs are here, http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Changethesearchmode. More about the fields command, http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Fields. ... View more

There are a number if commands for admin purposes. http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/CLIadmincommands ... View more

I think you may need rest_apps_management to add apps. We only let admins install apps in prod so cant say for 100%. Below is a list of all capabilities, worse case a little trial and error will get you there. http://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities#List_of_available_capabilities ... View more