Hi @praspai , Have u got any soln for this kind of problem? ... View more

Hi @dfofie, Did either of the answers below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!! ... View more

Add a stanza in user-prefs for [role_<role_name>] in user-prefs.conf in system/local or in your app and then use the line tz = <timezone> . You probably want to test doing it to one user with the Splunk GUI to make sure you are using the correct string for your timezone value or use a library of canonical timezones. ... View more

You will need a heavy forwarder to run the python scripts that extract the FIM and SCM data. The universal forwarder will work for the TCP syslog...a subset of the data collected. ... View more

Hi this will help. docs.splunk.com/Documentation/Splunk/6.2.2/Data/Configuretimestamprecognition To configure how Splunk Enterprise recognizes timestamps, edit props.conf . There are a number of attributes that pertain to timestamps. In particular, you can determine how Splunk Enterprise recognizes a timestamp by using the TIME_FORMAT attribute to specify a strptime() format for the timestamp. You can also set other attributes pertaining to timestamps; for example, to specify where a timestamp is located in an event, what time zone to use, or how to deal with timestamps of varying currency. ... View more

When the phoneHomeIntervalInSecs is changed, you must restart the forwarder. That is usually not a problem on a forwarder. However, it could be a problem on an indexer or search head. I don't know if this will work but you could try http(s)://yoursplunkhost:8000/debug/refresh or the equivalent REST endpoint. I know this causes Splunk to rescan props.conf and transforms.conf, but I don't know if it will pick up deploymentclient.conf ... View more

Here is a small modification to show the last 30 days in a chart. It works for a single pool, but could be modified for multiple pools. Good to see how things are changing, and it is efficient: index=_internal source=*license_usage.log type=RollOverSummary | timechart sum(b) as b max(poolsz) AS poolsz span=1d | eval PercentLicense = round((b/poolsz * 100),1) | fields - b poolsz Here is a small modification to show how much each index is using. It is good to run this over time "yesterday" (or some 24 hour time period) index=_internal source=*license_usage.log idx=* | stats sum(b) as b max(poolsz) as poolsz by pool, idx | eval percent = round(b/poolsz * 100,1) | eval GB=round(b/1024/1024/1024) | eval "License GB"=round(poolsz/1024/1024/1024) | fields - b poolsz | addcoltotals labelfield=idx label=Total GB percent ... View more

If you are up for it, send me an email and I can get you the assembly for testing against VS 2010. ... View more

Here is something simple and similar to the above answer, but is all cli. Replace localhost with your host ip/hostname Replace testdude with your username which you must know the password for. Then run it. read -s -p "Enter Password: " mypassword;t= curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword ;mytoken= echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d' ;curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10";mypassword="";mytoken="";t="" Here it is broken down. read -s -p "Enter Password: " mypassword; allows you to enter password with entering it on command line and stores it in a variable, which is cleaned up at end. t= curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword ; stores tokenized output in variable, which is cleaned up at end. mytoken= echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d' ; uses above variable/output and strips it down to just token and stores it in variable curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10"; uses token to run search mypassword="";mytoken="";t="" cleaned up of variables used. P.S. Please shoot holes/refine it. I think it will make it more useful for everyone. ... View more