Indeed, looks like an issue with reports. I inserted the full search query into a dashboard panel, gave it full visibility and it finally worked. I tested with three different users. Solved. ... View more

The search is owned by me. I modified as shown Show to Owner: works for owner, others don't see it. Shared to App, runs as Owner, All R&W: works for owner, others see it amongst Searches but shows no email. Shared to App, run as User, All R&W: works for owner, others see it amongst Searches but shows no email. It works in the last configuration if I login as "admin", and admin's email address is shown. But not for other logins. As admin I tried to share the report to all Apps (Global), same behavior: for normal users the saved search returns nothing. The "Inspect > Search log" for a working and a non-working case is the same. ... View more

Additional info. The big plan is to allow any user to authenticate on Splunk and see a read-only dashboard with an analysis of her/his operations as found in indexed logs (such as Country of last access, incoming/outgoing email/antispam statistics, ...). I need to determine their email address automatically and I think there's no other way than the REST call to current-context. ... View more

Findings after further investigation. Browsing further into the preview the timestamp gets recognized and importing the 2014 CSV works, except for first ~100 events. But CSV from year 2013 has the time in hh.mm (dot instead of colon) and I cannot import it. Curiously, if I preview the extraction of date or time only, the TIME_FORMAT (%d/%m/%Y or %H.%M) is comfirmed to be correct. Concatenation doesn't seem to work (reliably). Swapping date and time neither. I would prefer not to edit the source CSV with +700k lines. Splunk version 6.2.2. ... View more

Even in 6.2.2 the Line Chart in Pivot doesn't accept a custom X-axis field. The solution by gauldridge worked for me too. It is still a loooong way to get a multi-day overlapped chart, but at least it is now possible with pivots. ... View more

When I call "http://searchhead:8000/en-US/app/launcher/home" I get redirected to "http://searchhead:8000/splunk**//**en-US/account/login?return_to=%2Fsplunk%2Fen-US%2Fapp%2Flauncher%2Fhome". Note the double slash before the locale. If I manually edit the URL and let only one slash then access is possible. Problem is: when I log out I am thrown again at an URL with double slash, that won't let me in. We can correct our bookmarks, but it worked with all Splunk versions throughout 6.1.1 and broke on 6.2.2. Is there a config setting to tweak? This happens with all locales I tried: en-US, en-GB, it-IT. ... View more

Thank you for jumping in. It's a all-in-one-box that worked until we upgraded to 6.2.2. We use LDAP auth, but "admin" has always authenticated against the Splunk internal password db. Neither admin nor LDAP accounts can now access Splunk webUI. Tried IE (first time it met Splunk) and FF36 on Win7, with clean cookies: "Server error". The server is not swapping to disk. I am currently at home and cannot provide other details. Please let me know which other environment info could be useful. ... View more

Going further with debug, I activated ALL possible debugs and filtering out events I came up with this: 03-09-2015 15:35:10.609 DEBUG HTTPAuthManager - login... 03-09-2015 15:35:10.609 DEBUG AuthenticationManagerSplunk - Attempting login for user 'admin' 03-09-2015 15:35:10.613 DEBUG UserManagerPro - user="admin" successfully logged in 03-09-2015 15:35:10.613 DEBUG HTTPAuthManager - login successful 03-09-2015 15:35:10.613 INFO UserManager - Setting user context: splunk-system-user 03-09-2015 15:35:10.613 INFO UserManager - Done setting user context: NULL -> splunk-system-user 03-09-2015 15:35:10.613 DEBUG AuthenticationManagerSplunk - Getting info for user: admin 03-09-2015 15:35:10.613 DEBUG AuthenticationManagerSplunk - Getting info for user: admin 03-09-2015 15:35:10.613 DEBUG AuthenticationManagerSplunk - Getting info for user: admin 03-09-2015 15:35:10.613 INFO UserManager - Unwound user context: splunk-system-user -> NULL 03-09-2015 15:35:10.613 ERROR UiAuth - user=admin action=login status=failure reason=bad-cval useragent="Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0" clientip=10.1.2.3 I doubt I can get more info out of debug logs. If I am wrong, please suggest how to proceed. This is a live, production, Splunk instance with GBs of logs per day, non-stop indexing. ... View more

"cval" is one of the cookies set by Splunk. But even cleaning up the browser doesn't solve the issue. The cookie is regenerated (sample content 657767914). ... View more

I am not sure what you want to achieve, but you probably need to write an external command that opens the SSL connection, dumps the certificate and produces a Splunk-able output. Python has client SSL support, and maybe it supports dumping cert attributes. ... View more

Would it work? <your search here> | transaction maxspan=70m ComputerName startswith="ActionTaken=None" keepevicted=f | search NOT Blocked NOT removed NOT quarantined | table ComputerName, VirusName ... View more

How is the Jmeter input configured? Are you sure that there is no "backslash_r" or "backslash_n" hidden in the slow log line? See http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Indexmulti-lineevents for info on event breaking. ... View more

Note: I am familiar with LDAP and AD/LDAP, not with the App in question. Have you provided "ldapfilter" a valid login and password to access AD? Note that you probably need to provide the full DN of the user, as seen via LDAP. Test the LDAP BIND via an "ldapsearch" (on Linux), like: ldapsearch -xh your.ad.host.example.com -p tcp.port.of.AD-LDAP.example.com -D "DN of the user best with double quotes" -W -b ... View more

Hello. Can you tell us exactly which is the timestamp in the example? Is the event multiline exactly as shown? Do your events look all the same? (Same format, same line length, same begin string, ...) ... View more

Have you tried to enable boot start while splunk user still has a valid shell, and then changing it back to /bin/false? Does it start at reboot (or "service start splunk")? ... View more

We started with LDAP authentication right away, except for "admin". In my setup, per-user information is stored in /opt/splunk/etc/users path. The "admin" user, which authenticates locally, is also listed there. I have not tested what happens if the same userID is used on multiple authentication providers (local, LDAP, ...). In worst case you can copy user preferences at disk level from local user path to LDAP user path. ... View more

@alucas_1stop . I am not sure where the problem is. If you need to split by time, which is not shown in your example, how about "| bucket _time span=1m | stats count as CPM by ClientIP Hostname _time | search ..." Then I tried playing with find anomalies commands but did not come to a meaningful result. ... View more

coalesce is the way to go. If you have the proper sourcetype, you may have queued_as field, so "| eval matching_id=coalesce(queued_as,queueid) |" will do and you can drop the previous "rex". Be aware that you may get the same queue_id value on both servers within the maxspan timeframe, so consider differentiating your transactions adding the host field too: "| transaction queue_id, host ..." Splunk can tame the "Postfix logs" beast! 🙂 ... View more

THAT'S IT! Nested subsearch with a clever trick. I only needed to add double quotes to the eval: ... eval to="$to" ... otherwise it complains of the @ symbol. ... View more