yes there is, just add an all at the end, so | rest /services/data/inputs/all splunk_server=indexer1 ... View more

fantastic, thank you ! Is there anyway i can pull details of a specific input ? ... View more

I know I need to look at the input file on the indexers, that was my original question ! I don't have access to the indexers, I need to look at the inputs file from the gui of either the search head or cluster master. ... View more

Data is being sent via syslog to the indexers. No TA is beging used, neither is there a deployment server. We don't have a clustered search head architecture, just a clustered index, so the cluster master is just to cluster the indexers. ... View more

that sets it to the current time, I want it to set it to the time the file I am indexing was created ... View more

that doesn't work unfortunately, is there an issue with my props.conf ? ... View more

as an aside, the delete command doesn't actually delete the logs, it jut makes them unsearchable. So if you're looking to save some disk space this might not be the best method to use. ... View more

thank you, this worked. But I don't understand why. The parsing has happened long before I search for it in the search head, why does the sourcetype need to be on the search head ? ... View more

Just for future reference - I had the same issue, none of the above solutions seemed to work but when troubleshooting, I found it was an issue with DNS on my server rather than a splunk related issue. After I fixed my DNS resolution everything worked perfectly. ... View more

Are you using a distributed environment? If so, which admin to which component of Splunk cannot return the results? This will make a difference. At first glance, I would say this is a permissions issue if one user can access the data and another can't, it would also be useful to see your full search query and to make sure you are running the searches from the same app in Splunk, just in case you're relying on any app specific commands/lookups. To see which users have access to which indexes you will need to run the below as an admin on the searchead, I would also run it as the user who can see the data, | rest /services/authentication/users | rename title AS username roles AS role | mvexpand role | fields realname username role | join type=outer role [ rest /services/authorization/roles | rename title AS role | eval indexes=mvjoin(srchIndexesAllowed," ; ") | fields role indexes] | table username role indexes This will gives you a list of permissions. let me know how you get on. ... View more

Could you provide a bit more detail with examples of what your data looks like currently and how you would like it to look? ... View more

also be careful about saving large lookup files on your search head. You may bump into issues with syncing your bundle across indexers if you hit your maximum bundle size. You may need to whitelist the lookup folder within that app > https://answers.splunk.com/answers/3436/how-could-i-optimize-distributed-replication-of-large-lookup-tables.html ... View more

Thanks, but this didn't work.When I rename edgeRequest.httpMethod to method I get the same issue, which to me means the field name has nothing to do with the issue, I think it's the value itself. Would you know how I could troubleshoot a search? ... View more