I would like to see examples of perfmon inputs.conf settings. I tried setting up Windows perf mon using the Splunk web as documented here: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/MonitorWindowsperformance I expected an inputs.conf file to have the settings I configured using the Splunk Web. But I can find no inputs.conf file that has been modified and has the perfmon information. When configuring perfmon from Splunk Web where are the setting stored? Does not seem to be in a conf file. ... View more

We have an accelerated data model and would like to be able to use a where clause from TSTATS that includes: _index_earliest=-h@h AND _index_latest=@h _indextime does seem to be a field that is available in the DMA. But trying to use the where clause above does not work. We want to generate TSTATS values for events that have been indexed in the previous hour. Here is the full SPL: | tstats min(_time) as _time sum(nmds_app_dest_survey.bytes) as bytes sum(nmds_app_dest_survey.flow_count) as flow_count FROM datamodel=nmdm_app_dest_survey WHERE _index_earliest=-h@h AND _index_latest=@h BY nmds_app_dest_survey.dest_and_port ... View more

I have a dashboard that I only want to have visible if specific user roles, admin and miq_admin. When I log in as a user with miq_user role menu item is still there and can click and view the dashboard. Using splunk 7.3.0. I have restarted splunk and still not working as expected. ... View more

Seeing lots of "SearchEvaluator - using old evaluator" in search.log for TSTAT with DMA. Could someone please explain what this means? Only seeing this with Splunk 7.3. Not seeing for the same search with 7.2.5. ... View more

Trying to limit search duration to 30 days. Working as expected except with data models and tstats. Should srchTimeWin work with tstats? authorize.conf: [role_user] srchTimeWin = 2592000 ... View more

After updating a system from 7.1 to 7.2 and changing the tsidxWritingLevel value to 2, will existing indexes be regenerated to the new format? The text below is from Splunk docs... http://docs.splunk.com/Documentation/Splunk/7.2.0/Installation/AboutupgradingREADTHISFIRST Significant tsidx performance improvements are turned off by default Splunk Enterprise 7.2 introduces a change to the file format of tsidx index files, resulting in significant size reduction. The reduced file size leads to improved search performance through decreased I/O, improved utilization of SmartSearch caches, and so on. This change is beneficial under all circumstances. However, to upgrade multisite indexer clusters without search interruption, it is necessary to defer the format change until after the upgrade completes and all peer nodes can switch to the new format simultaneously. For this reason, Splunk Enterprise 7.2 ships with the feature turned off by default. Turn this feature on, immediately after you complete your 7.2 upgrade. To turn on the feature, edit indexes.conf on each indexer (or, in the case of indexer clusters, in the master node's configuration bundle). Set tsidxWritingLevel to 2. Make this change in the default section of the file, so that it applies to all indexes: [default] tsidxWritingLevel=2 ... View more

The following SPL is returning multiple values for nmds_adapter_survey.iccid when the where clause is set to a value. It should only return the specified value. | tstats values(nmds_adapter_survey.iccid) values(nmds_adapter_survey.hcar) values(nmds_adapter_survey.c_id) from datamodel=nmdm_survey where nmds_adapter_survey.iccid="89014103255440210384" Results: Setting the where clause to any numbers for the last 4 characters returns what matches the first 16 characters. The where clause below returns the same values as the SPL where clause above. where nmds_adapter_survey.iccid="89014103255440210000" In the data model the iccid value is defined as a string. ... View more

We have a simple xml dashboard that has many charts that reference saved searches that are run every night at 3am. Since upgrading to Splunk 7.1.1 when we reference the saved search in our dashboard the search that is used is NOT the most recent saved search it is the oldest. This was not the behavior in Splunk 7.0.x. savedsearches.conf: [DatesPrevious30Days] run_on_startup = true alert.track = 0 cron_schedule = 0 3 * * * dispatch.earliest_time = -30d@d dispatch.latest_time = @d enableSched = 1 search = index=nmi_main source=netmotion sourcetype=nm_session \ | fields _time \ | stats min(_time) as firstTime max(_time) as lastTime \ | eval totalDays=round((lastTime-firstTime)/86400,0) \ | eval firstTime=strftime(firstTime, "%a %b %e, %Y") \ | eval lastTime=strftime(lastTime, "%a %b %e, %Y") ... View more

In 7.0 the color attribute in nav of default.xml controlled the background color of the menu in a simple xml application. In 7.1 it controls a new highlight bar showing the current menu selection. See screen shot. Is there a new attribute to control the actual background color of the menu area? <nav search_view="search" color="#32CD32"> ... View more