Hi, you will need to pass count: 0 in your search parameters to get all results... refer here Eg... for a One Shot search var searchParams = { earliest_time: "2011-06-19T12:00:00.000-07:00", latest_time: "2012-12-02T12:00:00.000-07:00", count : 0 <-- Add this }; ... View more

Hi, The positional arguments for the alert are available as env var. If the JSON you are working on is in the search results you should be able to access it from the dispatch file... os.environ['SPLUNK_ARG_8'] eg: import os json_results = os.environ['SPLUNK_ARG_8'] Check out full details Here However, if you are planning to email out the formatted results, I think it will have to be done from your script itself. From the alert perspective the email and the script are triggered per the same condition... ... View more

Hi, Buckets are not just limited to replication activity, they also include data being received. Depending on your deployment and how your forwarders are configured it's possible that some of your systems are forwarding to only few of the indexers in your cluster causing them to have higher bucket counts. Eg: if you have a cluster of 8 indexers with a replication factor of 2, but some of the forwarders in your environment are only set to forward to 3 of these, you will naturally see more buckets on these irrespective of your replication activities. Similarly it's also possible that firewalls might be blocking the forwarder access to some of your indexers (again depends on your env) causing the same issue. If you have set up custom load balancing on your forwarders, it can also cause this... there might be other similar reasons.. but you get the idea. ... View more

Hi, You can use appendcols.... something like (assuming and alert name of "aname"): |inputlookup yourlookupfile|search alertname=aname alertdate="*Sep 25*" AND alertstatus="Problem"|eval stime=strptime(alertdate, "%a %b %d %H:%M:%S %Y")|appendcols [|inputlookup yourlookupfile|search alertname=aname alertdate="*Sep 25*" AND alertstatus="OK"|eval etime=strptime(alertdate, "%a %b %d %H:%M:%S %Y")]|eval problemDuration_Min=((etime-stime)/60)|fields alertdate,alertname,host,hostname,problemDuration_Min you can tweak your search criteria per your requirement... Check out available time functions and Date/Time format options ... View more

Hi, The UIs for user password changes by default are stored within the "search" app. So when you remove the read access to this app there is no way to render the ui for that user. Try copying the xml from the default search app.... usually: $SPLUNK_HOME/search/default/data/ui/manager/authentication_change_user_password.xml to the default app set for the specific user role. Use the same path ... create "manager" dir if necessary. Also assuming that your user role has the change_own_password capability set... as it seems like it was working before. Hopefully this should fix the issue for you. ... View more

1.Do I need more Splunk instances? Ideally Yes. A search head cluster requires a minimum of 3 members. So with just two search heads you will not be able to have a search head cluster. Also for indexers, your options depend on your need for resiliency, the cluster can tolerate a failure of (replication factor - 1) peer nodes. And there are benefits to having a separate cluster master for your indexers. Search head cluster will need a deployer as well. You do have the option of having a server take on multiple roles... still if your preference is to have both a search head and an Indexer cluster you will need more servers for a clean deployment. 2.Do I need to send syslog to only one indexer, or the same syslog to two indexers? To get the maximum performance benefit it's preferable to send your data to all indexers (distribute the data). So when the searches hit the indexers, each peer node can process it's set of results and render them back much faster. 3.If I send data to only one indexer, with replication, will I have the same data in two indexers? Yes. Else when an indexer goes down, your data is lost. Clustering requires indexers maintaining replicated copies of the data (as defined by the replication factor) 4.If I send same data to two indexers, with replication, will I have data copies twice, in two indexers? I am assuming you mean, you want to send the data to two indexers and not send the "same" data (clone) to two indexers. You can also have the option of using an intermediate forwarder which will load balance the data for you. But yes, depending on how you will be sending the data there is the possibility of having duplicates ... which will get replicated. 5.If one indexer is down, will the other one be enough for service continuity? Yes. If you enable clustering, a replication factor of 2 will ensure availability even on failure of 1 peer node. 6.If I have a traffic balancer, only for sending syslog data, can I send data to any indexer, do I need any special consideration? Sending data to any indexer is fine... though as explained it’s better to distribute the data. Additionally there is excellent documentation on clustering. Check out Indexer Clustering and Search Head Clustering. Good luck with the deployment. ... View more