I just did a fresh install of 7.2.4 and installed my dev/test license. I am trying to test email alert functionality, which worked on this system when a previous version was installed. The search fires and appears to trigger the alert action but it looks like sendemail is failing. This is the message in the python.log: 2019-02-08 15:45:01,734 -0500 ERROR sendemail:1397 - [HTTP 404] https://127.0.0.1:8089/servicesNS/admin/search/saved/searches/Splunk%20Web%20Login?output_mode=json I am not sure if this a bug which needs to have support check into it, or if it is due to using a dev/test license under this version. I did not have this issue with a dev/test license under older versions. I did set up this instance with a different admin username than admin however, so I am not sure if this is related. ... View more

We are in a transition phase with Splunk Cloud and forwarding to Splunk Cloud index endpoints as well as an on-prem indexer cluster. Does having two tcpout outputs defined effectively double the throughput being measured when maxKBps is exceeded and throttling takes place? This is mostly relating to Universal Forwarders as they have a default of 256 KB/s (as does the app that splunk cloud provided for forwarding to splunk cloud). ... View more

Hello, I have a dashboard using some of the Visualizations from the Machine Learning Toolkit that I converted to HTML in order to do some interaction with the app's KV store. I would like to programatically change the visualization type under certain conditions. Here is the div containing the viz: <div class="panel-element-row"> <div id="element1" class="dashboard-element viz" style="width: 100%"> <div class="panel-body"></div> </div> </div> Here is the viz element in the JS: var element1 = new VisualizationElement({ "id": "element1", "type": "Splunk_ML_Toolkit.OutliersViz", "drilldown": "none", "trellis.enabled": "0", "resizable": true, "trellis.size": "medium", "trellis.scales.shared": "1", "refresh.display": "progressbar", "managerid": "search1", "el": $('#element1') }, {tokens: true, tokenNamespace: "submitted"}).render(); If I try to set the type setting on element1 as follows it appears to change its assignment if I then get the type, but the visualization stays as an OutliersViz. I have tried calling render() and some other methods but none actually make it re-render as the desired type: else if (form_countTMethod == "TSF") { methodString = tsfSearch; element1.settings.set("type","Splunk_ML_Toolkit.ForecastViz"); console.log("element type:",element1.settings.get("type")); element1.render(); } ... View more

I created some searches with timecharts and added them to a dashboard. Since the searches take some time, I thought I would try to convert them to reports and schedule them (I actually only need them to run once since the data is now historical) so that the dashboards would just load pre-populated reports. I used the "Convert to report" option while editing the panels. I then tried running the reports. It seems that in the dashboard however, the reports are re-run every time the dashboard is loaded. Is what I am trying to do not possible with scheduled reports? ... View more