Both myself and other people using the same Splunk search head as I see this. The default charting.axisY2.maximumNumber set itself to 100 in the view for charts. If I remove it manually, it works, it will start to use auto . But only till I refresh the chart, create another chart, or just browse around. If I have a chart in a dashboard, there is no way for me to make it be auto when I view the dashboard. It sets itself to 100 , and a minimum value of 0 . If I look at the xml for the dashboard, I can see that charting.axisY2.maximumNumber is set to auto . I have looked around for settings defining this, and tried to find an answer online, but I can't find anyone that have had the same problem. Splunkversion: 6.3.1 Build: f3e41e4b37b2 I have tried to reproduce this on another Splunk I have access to, and it doesn't behave this way. The one I tried was version 6.3.0 ... View more

Hi In this setup, we have servers for each universal-forwarder -> forwarder -> indexer -> searchhead. I am testing adding Linux logs (/var/log) to Splunk, but I wont pollute the splunk indexer with -any- learned sourcetypes. If Splunk can't figure out the sourcetype based on its rules, the sourcetype should be set to 'linux_logs_unknown'. We have managed to get rid of all the XXX-too_small entries by putting this in the props.conf on the universal forwarders: [too_small] PREFIX_SOURCETYPE = False But I am still getting sourcetypes of eg, smbd-5 for source=/var/log/samba/smbd.log. And sourcetype=wb-DOMAIN.log for source=/var/log/samba/wb-DOMAIN.log. Note that this problem is not only for samba, its for everything under /var/log. I am still somewhat new to Splunk, so please give examples 🙂 ... View more

We have a splitted environment where we are using another tool to take care of typical monitoring like cpu, disk, memory usage and so on. This other tool are also used to generate stats, create incidents, decide if someone has to be woken up at the middle of the night and so on. This wonderful tool can also watch logs, so my plan is that Splunk (and maybe some other custom scripts running in cron), logs alerts to this tool to a single logfile. In other words, if "TIMESTAMP Critical A custom message here" is logged to the file /var/log/something.alerts someone will/should be called. My problem is that creating an alert using savedsearches and action.script will only run on the searchhead itself. Is it possible, to: Create a splunk alert that populate a log on the universal forwarders themself. Do parsing (savedsearches logic) based on rules in my inputs.conf on the uf? insert more elegant solution here ... View more