This post is a few years old but to aid those who have spent hours trying to find the answers and end up here for help.... In my case I saw the "killed by signal 9" because of the proxy configuration...  I had 2 different cases of 'signal9'.  The solution for one case was the application itself allowed the proxy to be set in the app settings and in the other case this was the solution Can you configure the Duo Splunk Connector to use ... - Splunk Community.   ... View more

Stray emacs temp files can apparently cause this sort of error as well.  (as of 8.2.x). E.g. .../default/data/ui/views/.#example.xml   ... View more

maybe the disk quota if you see the error for specific user roles. ... View more

I basically follow the Splunk doc I post to set it up. And IDP & SP initiated SSO are both used in SAML in default. I believe there're lots of blog taking about both SSO initialization like this: https://blogs.oracle.com/dcarru/sp-vs-idp-initiated-sso ... View more

You should be able to access the schedule_window parameter by going into Advanced Edit for the search/alert. If you still cannot see it, make sure the user has the schedule_search and edit_search_schedule_window capabilities. ... View more

That made it indeed a bit faster, I'll leave it at since it's working now. I made a request to the people providing the lookup tables if they could incorporate an extra field with the length of the masks so I can join on that. Saves 2/3 of your suggested query 🙂 Anyway thanks a lot for your help, much appreciated! ... View more

I have 40 indexers. Why would this type of error come from only one particular indexer? ... View more

Thx for the response. I was afraid that was going to be the answer but at least I know for sure now. I'll look into it and possible alternatives. ... View more

The last part of the logging is below; looks kinda normal to me. It just appears to be running but nothing gets into Splunk. Except for the first several random events after a restart. The ta_vnx_collection.conf was at default at first (60 and 360) but I tried it with a 10 times longer interval as well (600 and 3600). 2015-10-26 13:31:46,257 INFO 7240 - Start vnx_data_loader://xxx. Metric=vnx_block_performance 2015-10-26 13:31:46,257 INFO 7240 - start collect sp perf for XXX.XXX.XXX.XX 2015-10-26 13:31:47,398 INFO 7240 - end collect sp perf for XXX.XXX.XXX.XX 2015-10-26 13:31:47,398 INFO 7240 - start collect drive perf for XXX.XXX.XXX.XX 2015-10-26 13:31:47,757 INFO 7240 - end collect drive perf for XXX.XXX.XXX.XX 2015-10-26 13:31:47,757 INFO 7240 - start collect rg device perf for XXX.XXX.XXX.XX 2015-10-26 13:31:48,101 INFO 7240 - end collect rg device perf for XXX.XXX.XXX.XX 2015-10-26 13:31:48,101 INFO 7240 - start collect pool device perf for XXX.XXX.XXX.XX 2015-10-26 13:31:48,664 INFO 7240 - end collect pool device perf for XXX.XXX.XXX.XX 2015-10-26 13:31:48,664 INFO 7240 - End vnx_data_loader://xxx. Metric=vnx_block_performance 2015-10-26 13:31:49,289 INFO 9716 - Start vnx_data_loader://xxx. Metric=vnx_block_performance 2015-10-26 13:31:49,289 INFO 9716 - start collect sp perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:50,632 INFO 9716 - end collect sp perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:50,632 INFO 9716 - start collect drive perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:50,993 INFO 9716 - end collect drive perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:50,993 INFO 9716 - start collect rg device perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:51,414 INFO 9716 - end collect rg device perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:51,414 INFO 9716 - start collect pool device perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:52,071 INFO 9716 - end collect pool device perf for XXX.XXX.XXX.XX1 2015-10-26 13:31:52,071 INFO 9716 - End vnx_data_loader://xxx. Metric=vnx_block_performance ... View more

Thanks for the response. I actually found that documentation before but after checking again, it seemed the user wasn't correctly created on 1 of the search heads. After recreating the user on the last search head, the edit button reappeared on all the dashboards. Seems weird these things are related but hey, i'm happy it's working again. ... View more

Thanks for your reply, but the question was over a year old and fixed already. The issue was fixed with the release of the Splunk version that supported ADFS and AzureAD (6.4 if I remember correct?). We use ADFS, and before it was supported we tried some proxy work-around that apparently broke something in Splunk for some reason. ... View more

You sir, are a lifesaver! Alternative 1 did the trick. Also while not needed, great idea using a lookup table, don't know why I didn't think of that myself. ... View more

You'd probably want to replace the timechart with this: ... | bucket span=1d _time | stats avg(Value) as yvalue by VMName ... Then the following calculations should work, add a timechart to the end if required. Note, this will incorrectly ignore days with zero events for a VMName instead of considering them a zero. If that's relevant for your data then there's a bit more work to be done. ... View more