Cheers Woodcock works for me. ... View more

Use maintenance-mode for extended periods (such as this one) ... View more

I am using ORDER BY clause for time_period column but I am using DESC instead of ASC and It causes duplicates in indexes all the time and my index count went up to 2 million rows but mu DB only has total 9k rows and I am checking this every 30 sec. So, does DESC causing this duplicate rows? ... View more

Hi, There is known bug in DB connect. props can't be overridden. Reference: DB connect release notes: link text Here is the solution which I have come up with. you can use if you like this. My McAfee logs in UTC & My Splunk server is running in UTC+4. I have added below line to query it self. SELECT dateadd (hour , 4 , [EPOEvents].[ReceivedUTC]) AS [timestamp] from xyz you can look for sql functions as per your database & I found this is best solution as of now. ... View more

I submitted a ticket with Splunk support and based on their preliminary examination of this issue they believe it may be a bug. ... View more

Another way to handle this is with Character Data clause, better known as CDATA : https://stackoverflow.com/questions/2784183/what-does-cdata-in-xml-mean ... View more

Doing this cuts the bundle size down by about 70MB to the indexers. Seeing as the splunk_archiver app is part of every splunk install, not sure why Splunk really needs to bundle this up by default and send it down to all the indexers - especially because in 90+% cases most folks are not using hadoop archiving. ... View more

Did you install the UF version of Splunk (there are different packages)? Have you deployed any INDEXED_EXTRACTIONS= configurations to the UF? ... View more

Thanks esix, I did some additional testing and can confirm all of the above. ... View more

I was looking through the IMAPmailbox app on splunkbase. there is a genpass.sh script in there that takes the user's input as well as the splunk.secret to generate an encrypted password. Lunk to IMAPmailbox app: https://splunkbase.splunk.com/app/1739/ genpass.sh code: #!/bin/bash #Jimmy J - 07/15/2008 #Modified this script to use the /bin/bash shell as opposed to the /bin/sh shell. The /bin/sh does not interpret the -n flag #correctly on mac i.e. the trailing newline is added to the password #No need of a key file to save the key used for encrypting/decrypting the passwords. #We now use the splunk.secret key that comes with every installation of splunk echo -n "Enter the password you want to encrypt:" stty -echo read pass stty echo echo "" echo -n "Enter it one more time to make sure you typed it in correctly:" stty -echo read pass2 stty echo if [ $pass = $pass2 ]; then echo "" echo "" echo -n $pass | openssl bf -e -a -pass file:$SPLUNK_HOME/etc/auth/splunk.secret echo "" echo "Copy the string on the line above and paste it into" echo "local/imap.conf as the value for xpassword." else echo "" echo "" echo "Exiting" echo "Sorry, your passwords did not match." fi Essentially it's using the openssl blowfish cipher to encrypt in base64 using the splunk.secret as the password source. One thing to consider is that the splunk.secret will be different between all of your index cluster members, so there is that to consider. Hopefully this helps you out. It certainly helped me out. ... View more

It could be they had private objects that were periodically refreshed. Maybe field extractions or saved searches? Even if the objects were disabled, the files would still be touched periodically to be reloaded. ... View more