Is it possible to start a new search in a new window or tab just by clicking on part of an entry in my current results? ... View more

I'm trying to determine what percentage of my daily indexing volume is made up of a specific group of logs. For example, I want to know the volume of all the logs with EventCode = 4720. I know how to find total log volume over a given time period, but I haven't been able to get these strategies to work with the EventCode specification. Can I make this work? ... View more

I'm able to log in to the web interface and I'm a splunk admin. But when I try to log in on the command line I get a login failure. Is this something that's been seen before? EDIT The failure message says "Login Failed," I'm using bash on a Red Hat box. All local accounts, my coworkers can login to their splunk accounts on the CLI, but I can't. EDIT 2 I tried again as the splunk user on the box, and the login worked fine. Is there a way to open that capability up to a user other than splunk? ... View more

I'm trying to test some things with my Splunk Windows installs and I'd like to have reliable test data. When I test *nix logs with Splunk I tend to use 'logger' to create the messages. I've been unable to find an equivalent for Windows (preferably 7). Does something like that exist? or is there a technique to force Windows to send logs (without having to actually do the action that makes the log?) ... View more

In the past, one of my coworkers was working on a whitelist/blacklist solution for our Windows logs (dropping certain EventCodes and keeping others, etc.) Now, that task has fallen to me. I'd like to test this on a distilled version of our log data for ease of verifying the results, but I'm not sure how to go about that. I've got a file with copies of our Windows Logs, would it be enough for me to point a Splunk instance to them for indexing? Or do I need to push them through a Windows instance? ... View more

I just ran a search over the last 24 hours which returned a large number of results, but not the full picture I was looking for. So I extended the time frame to the last 7 days. Doing that reran the whole search, including the results I'd already amassed over the last 24 hours. I could feasibly open a new window and run the search over 6 days, and have the two sets of results to work with; but is there a way to concatenate these results together? ... View more