I got a message from splunk when I signed up for answers, saying something like "add som style for your posts", but I have mislaid this. It would be nice to have a permanent post with formatting options, syntax help, keyboard shortcuts, rules and recommenadation for the answers site. But maybe there is such a post but I'm not capable of finding it? ... View more

It's possible from 4.1.5 to roll over indexes manually with ./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>:<admin_password> So it would be possible to add this as a cron job for this to appear on a weekly basis. But then you need to add a user with admin role and the password for this user in clear. It would be nice to let splunk itself run this command from a saved search, or as an internal command. There is already an internal cron running for splunk, creating reports and searches. Does such feature exist or on the roadmap? ... View more

If I have saved my searches globally, ie in the file $SPLUNK_HOME/apps/search/local/savedsearches.conf is it then possible to reload changes somehow? I have tried several restart/reload options but none seem to work. splunk _internal call /services/admin/search/data/ui/nav?refresh=1 splunk _internal call /services/apps// splunk restartss Obviously if I edit them in the GUI, they will be reloaded but I have changed names to them and would like the new names to appear. ... View more