Yes. There is not much point in sorting the summarized data. You should sort when you retrieve the data from the summary. Summarization is not for saving a report, but rather for saving data. ... View more

Is it also possible to not index certain data if you're not using a forwarder? Our setup is pretty simple in that we only have a single Splunk instance running without any forwarding. I've tried a number of times to set up Splunk to drop data based on the client IP by following the steps outlined but not having any luck! ... View more

Oh sorry I get it now. Extract the field the way you said, call it something else like "log_entry_host" and then stats count by log_entry_host ... View more

If you are looking for the classic : show me all events 10 minutes around midnight last night, you can use this version. index=_internal [|stats count| eval _time=now() | bucket _time span=1d | eval earliest=_time-60 | eval latest=_time+60 | table earliest latest | FORMAT "(" "(" "" ")" "OR" ")"] ... View more

I had the same issue. It occurs because the "viewstate" of the saved search overrides the dashboard XML. This is the opposite of the behavior for charts, and in my opinion is a bug. Workarounds: Use a search string instead of a saved search. Of course, then you can't use cached results, but it might work for fast searches. Edit your viewstates.conf file to remove the viewstate associated with the saved search (corresponding to the one mentioned in the relevant stanza of savedsearches.conf) and restart the splunk server. ... View more

NOTE: use the clean command at your own risk, ie. you will lose data if you do not have the raw data still available... ... View more

The event itself is probably using the IP address for the Host value. It might be helpful to see what Splunk has indexed for the host value of that event, as well as what is the extracted field value. To compare, run a search similar to the following: | metadata type=hosts | search host=<your_ip_address> | metadata type=hosts | search host=<your_fqdn> index=your_index source=udp:514 | fields host The value from the metadata searches are what is stored in the index, and the values from the search with | fields is likely the extracted value. ... View more

you can force reload of monitors in inputs.conf without a restart with e.g., ./splunk _internal call /data/inputs/monitor/_reload -auth admin:changeme ... View more