It'd be helpful if you can give a hint on how to import this code into Splunk SH to create the dashboard. I copied and pasted as source, it said 16 errors and couldn't save it. Thanks, ... View more

This is a good scripting approach to export large search results. This is another example of scripting: splunk search "index=_internal earliest=09/14/2014:23:59:00 latest=09/16/2014:01:00:00 " -output rawdata -maxout 200000 > c:/test123.dmp Thanks, ... View more

in outputs.conf, don't forget to add [tcpout] on top if it is not already there - like when you create a fresh new file. Thanks, ... View more

Hi - Splunk TS found the issue where port 8088 is being used by the other process. So, don't put port entry 8088 in your inputs.conf file. ... View more

Hi - Splunk TS found the issue where port 8088 is being used by the other process. So, don't put port entry 8088 in your inputs.conf file. ... View more

Hi - I have the same need. Have you figured out how to make it work? Please share. Thanks, ... View more

Thank you all. The issue was that the Linux admin renamed file splunkd.pid and assume this file would be recreated once Splunk restarted, but it didn't. Rename the file back to its original doesn't work, so this file needs to be manually recreated. Thanks, ... View more

Interesting, but it goes back only 48 hours. How to make it 7 days or with a time picker? My search is: index=wineventlog earliest=-48h | eval _time=if(_time>relative_time(now(), "-24h"),now(),relative_time(now(), "-24h")) | timechart span=24h count by login_status Thanks, ... View more

Hi, How can I regex <Type> Read Only </Type> to get "Read Only"? I mean only yield text between the tags. Thanks, ... View more

That fixed it. Thank you. ... View more

Wow, I see where it causes confusing. The tags were removed from my original post. That makes both current and desired outputs the same. The current output has smaller and greater signs at beginning and these signs with at the end. ... View more

Sorry for the confusing and here is the detail: Search: index=index1 | table eventdata Current output: eventdata <Type> View </Type> <Action> Edit </Action> <Source> Server Name </Source> Desired output: eventdata View Edit Server Name ... View more

Hi Woodcock, All I meant is that how I can remove tags .... in a string. For example: View , I only need my search to return View. The field name is EventData. Thanks, ... View more

Sorry, actually the field name is EventData with values like: View or Edit or Delete I try to only display the text b/w tags and (View, Edit, or Delete). Thanks, ... View more

This is the key to resolve the nasty issue - port 1025. THANK YOU. ... View more

Hello, I took me a great amount of time to get to what you shared here. My inputs.conf reads like below. The question is how you enable/disable this .conf file? Does the keystore_password matter (* or changeme)? Thank you, [splunk@splunkserver default]$ cat inputs.conf [server://default] config_file = ${SPLUNK_HOME}/etc/apps/splunk_app_db_connect/config/dbx_task_server.yml interval = 5 keystore_password = changeme start_by_shell = false [dbxquery://default] config_file = ${SPLUNK_HOME}/etc/apps/splunk_app_db_connect/config/dbxquery_server.yml interval = 5 keystore_password = changeme start_by_shell = false ... View more

Thank you. ... View more