Excellent Job!!! ... View more

You can still run the scheduling task on the splunk server itself and let it copy to the other machines so you continue to adhere to the described design. ... View more

Hi All, I have gone though all the answers and done all required changes in config but nothing will happend. Finally, I use below steps to reslove this issue. Backup your files, if exist, ex: db_input.conf and drivers Stop splunk. Remove db_connect app from app folder. Restart Splunk. Upgrade your splunk with just new version. install > db connect app check your db it will be okay now. Happy Splunking !.. ... View more

Note, that if your saved-search is a scheduled report, then the and tags do not apply in the dashboard -as far as I can tell anyway. All of the data created by the scheduled search over the scheduled time-period is displayed. If you remove the schedule from the saved search, then the "earliest" and "latest" tags will be applied in the dashboard as described above. ... View more

I downvoted this post because sadly this does not work as expected. bins=1000 means that splunk will determine some arbitrary number of bins that is less than 1000. ... View more