Simplest method. bin/splunk search "*" -uri https://remotesplunk:8089 If you want to use python SDK, there is no difference between running a search locally and remotely. They both use the REST interface to run the search. One thing to be aware of is 'admin' 'changeme' will not work remotely, because this is insecure. Be sure you are using an account without a default password. ... View more

I'm sorry. The detail you added helps, but it looks like such an unusual problem that I would contact Splunk Support. Sounds like a bug. As to the "before X" weirdness - since I wrote my answer I've seen that myself on scheduled searches. I think it represents some cosmetic bug in Splunk where scheduled search results no longer report their timerange properly to the Splunk UI. But how it's possible for a search that essentially ends with a stats count , to ever return zero results - that one I have no idea about. Hopefully Splunk Support does. Good luck. ... View more

I think if you index the headers of the email, then you will be able to search on that data as well. in imap.conf add "fullHeaders = True" or use "1" either way should work. Restart splunk and you should start importing the full email header fields. ... View more

No, there is not. ... View more

If obects like reports/alerts/dashboards are available across all search-heads in a pool, isn't it logical to assume that so would be the users? But they are not! (On 6.2.2) ... View more

I cannot say why without looking at the scheduler.log or splunkd.log but I would assume that maybe it is because the run duration of those searches is such that the scheduler cannot run new searches until some finish. ... View more

there's a chapter in the Distributed Deployment Manual about how Splunk uses different types of resources, here's the topic about search performance: http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Accommodatemanysimultaneoussearches ... View more

You can't. splunk's PDF generation works at the data level to generate a printable, and different, version of the rendered data. it does not simply take a screen print of the web page, which would be inappropriate and generally unreliable. ... View more

The x-axis should render its tick marks automatically based on number of bins and time span. When it doesn't yield the results we want, we can force the values we'd prefer to see by adding specific instructions in the simple XML. Here is some XML I recently used to force 15 minutes on x-axis <option name="charting.axisLabelsX.majorUnit">P0Y0M0DT0H15M0S</option><br /> <option name="charting.scaleX">1</option><br /> The full documentation is here: http://docs.splunk.com/Documentation/Splunk/latest/Viz/CustomChartingConfig-AxisGrid. The pieces relevant to above falls near the bottom of the page beneath the heading "Time axis label properties" ... View more

If your dashboard is created using only simple XML, I don't think there is any way to have the old PDF Server app handle it by default in Splunk 5. If you convert it to advanced XML and you have the PDF Server app installed and configured, then it will handle the printing. ... View more

Which version of Splunk are you seeing this in? ... View more

This error (usually!) comes from the way we store the search history on a per-user basis. We use a csv-storage component that does not handle the case of multiple updaters at the same time. When running many searches, it's possible to have overlapping updates to the per-user history csv file. The result is that the component that tries to help complete your searches with searchers that you have run recently in the drop-down box below the search bar will not have complete information. That is the only repercussion. Thus this message is usually completely ignorable. It was made somewhat less noisy in 6.x some version. If you are on 5.x it is more noisy. If you have other errors surrounding this message then there may be something worth investigating. ... View more

Have a look here; http://splunk-base.splunk.com/answers/66404/rangemap-problem-in-version-5 I explain there how to set it back ... View more

Unfortunately this isn't very helpful. I get warning "Unable to get viewstate information; formatting may not be correct" without any name of search or dashboard. I have found file savedsearch.conf in app Search, but there are hundreds of searches. Removing vsids from all search isn't good idea. ... View more

That's right. Index replication will replicate all the indexes. ... View more

Can enable skewing or schedule a bash script that spawns particular search requests every second. ... View more

No you will have to snap your time range to the minute (or the hour, day, etc...) example : earliest=-20m@m latest=-1m@m then the results will still be valid for the next minute. see http://docs.splunk.com/Documentation/Splunk/4.3.4/User/ChangeTheTimeRangeOfYourSearch#Specify_relative_time_ranges_in_your_search It is more useful for longer periods, by example (earliest=-20m@m latest=-5m@m, and have it run every 5 min) If you really want to update every minutes, then it will have to run every minute... ... View more

Does this work for 2 servers only? i.e. both servers acting as indexers and search heads? ... View more

Ooh, now I see that this post was rather old. Hope you've solved the problem already. ... View more

Yes, on the flip side, everything up until the 100GB part I agree with wholeheartedly and should definitely be followed 🙂 ... View more

Your update works for me. Thank you very much! 🙂 ... View more

@telrock did you ever solve this problem? We are having teh same issue and I tried to amend the python script with your suggestion, however, it did not resolve the issue. ... View more