Try searching Splunk for index=_internal source="/opt/splunk/var/log/splunk/scheduler.log" status!=success OR NOT INFO . You can also search directly in scheduler.log. ... View more

I downvoted this post because this 'answer' recommends visiting the question that the answer is supposedly answering. i think the poster meant to post this answer as an answer (or comment) on some other question. ... View more

upperperc 95 doesn't give the average of the top 5%. It gives an estimate of where the top 5% starts. If the biggest numbers in the top 5% are much larger than the smallest numbers in the top 5%, then the overall average can be bigger than more than 95% of the numbers in the sample. One simple example is where 96% of your numbers are almost the same, and you have a few numbers that are much much bigger. Then your average will be bigger than at least 96% of your numbers. See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions ... View more

Are you seeing bucket errors in SRVLOG2/...var/log/splunk/splunk.d? ... View more

That works for saved searches. Doesn't work for searches from the command line. ... View more

That works for saved searches. Doesn't work for searches from the command line. ... View more

For some reason, sendemail.py doesn't use the same parameters as scheduled search. Setting the server parameters in the GUI (Settings->Server Settings->Email Settings) will get scheduled search to work, but not sendemail. Saved searches look in users/XXX/search/loca/savedsearches.conf, and then in ./system/local/alert_actions.conf sendemail from the command line doesn't. Or doesn't seem to. Maybe it does but the configured parameters are being overridden by empty strings from the command line? Either way, if you don't want to always be typing server=XXX on the command line, one option is to edit sendemail.py and hardcode your server config: For eg: Instead of: server = ssContent.get('action.email.mailserver', 'localhost') Use: server = ssContent.get('action.email.mailserver', 'yourhost') ... View more

I have the opposite problem. Works from scheduled search, not from the script. By adding debug to sendemail.py I can confirm that when running from sendemail, it doesn't pick up the config that was set using the GUI. When running from scheduled search, it does. Strangely, I have two saved searches - one uses a value for action.email.mailserver from users/ben363/search/local/savedsearches.conf. The other saved search (same file) doesn't have that value - it uses the value from system/local/alert_actions.conf ... View more

And that's exactly what I've done. The worry is that it may happen again on a box where I don't have the same luxury. ... View more

Don't panic over messages like this: Audit:[timestamp=10-30-2014 11:52:06.304, user=admin, action=edit_user, info=granted object="admin" operation=edit][n/a] It's a check that you (as admin) have the right to perform edit_user. You get this, for example, when you open : Access controls Splunk is checking that you have the right to edit_user. The log entry doesn't mean that you, or anyone, exercised that right, only that Splunk checked if you could exercise that right. ... View more

You can only directly set a maximum retention period. The way to 'set' a minimum retention period is to manually calculate how fast you are accumulating logs and then make sure you have allocated enough disk space to your indexes. ... View more

There is an entry for Mail host under System settings >> Email alert settings >> Mail host Why this isn't also applicable to sendemail is a mystery to me. Feels like a bug. ... View more

See http://answers.splunk.com/answers/13420/sendemail-to-function-send-email-only-if-there-are-results.html ... View more

Adding the site to the list of trusted sites fixed the issue. ... View more

cont... Using the regular export raw format works, as you say, depending on what you want to export. Basically, it has to be close enough to Splunk's usual CSV format, or Splunk gets unhappy: "did not return events in descending time order, as expected". So marked up .csv could work, but if you wanted a more different file format, say .rtf, no luck. ... View more

Exporting to static works, but displaying the link to it doesn't. Having created splunk/etc/system/static/tmp/blah.blah, it can be read by pointing a browser at ...:8089/static/tmp/blah.blah. But it's not obvious how to export that as a link. If the script returns a link, then splunk displays that link, but as text, not as a hyperlink. Clicking on it takes the user back to the original search, it doesn't follow the link. The user can cut and paste, or if the filename is predictable, the user can be told what to type, which could sort of work, but isn't nice. ...cont ... View more

You can delete records you don't want, but it doesn't recover your quota, and it doesn't recover disk space. ... View more

The documents show that Splunk support for IE 8 stopped with Splunk 6.1. But I believe that Splunk 6.0 is still supported? We are running 6.0. (I also note that Microsoft still support IE 8. It may be end-of-life, but that means support is ending, it doesn't mean that support has ended (depending on what OS you are running.)) ... View more

That could work nicely... ... View more

I need to export in a custom format. ... View more