@mstjohn_splunk No, haven't had a chance to get back to it... but thanks for the follow up. ... View more

No. It is on the universal forwarder. The location of fishbucket on forwarder is, $SPLUNK_HOME/var/lib/splunk/fishbucket . And I just realized that, Splunk no longer lets you look at the fishbucket index but it's purpose is still the same (to keep track of pointers). From another accepted answer, The big problem with the fishbucket stuff that Andrea wrote about is that it does not apply in 4.x and up. It's accurate if you have a 3.x forwarder, but 4.x no longer stores the data in a Splunk index (it wasn't a good idea in the first place, though it was convenient for some purposes), but rather in the splunk_private_db inside the fishbucket index location. You can kind of examine the data using the $SPLUNK_HOME/bin/btprobe tool, but it's not that helpful, in particular because we are now only storing the hash and position, and not recording any of the other information that used to be in the fishbucket index. I think there might be some plans to add back some tools and info to get some of this functionality back, but you might want to file ERs on it. I updated my answer above. ... View more

Hi hkkenderson, blacklist is using regex to match, therefore you should use \. instead of just . . Try this: blacklist = app\.domain\.com\.access\.https\.log This assues you want to literally match one dot and not just anything one time. Hope this helps ... cheers, MuS ... View more

hi, Did you get to the bottom of this. I am in the same situation. Thanks ... View more

if you want we can do a webex session and see if we can find the core of the problem (my email rdagan@splunk.com ) ... View more

That did the trick, I knew it was something simple. Thanks ... View more

I've look at the documentation and it looks like I can use both maxTotalDataSizeMB and frozenTimePeriodInSecs to keep things in control. ... View more

Double check and see that your events are not being timestamped incorrectly and they are not appearing elsewhere in your index. Does it still show only one event if you directly reference the source file over all time? ie. index=blah source=/opt/jrun4/logs/server-2-event.log ... View more

sowings! YOU ROCK. That did the trick! ... View more

Ok, a few things could be going on. But let's get one thing straight--any user should be able to delete a knowledge object (such as a dashboard, saved search, or tag) that they have created but have not shared. Things get tricky when you share your knowledge objects with others or need to share or delete knowledge objects that others have created. First, you can only delete knowledge objects that have been shared or that others have created if your role has write permissions for the app to which they belong. So for example, to delete a dashboard that you didn't create or share that belongs to the Search app you'd need write permissions for that app. If you have the Admin role you should be able to delete objects in the search app, but if you have another role that has "equivalent capabilities" to the Admin role you won't be able to delete Search app objects that you didn't create or share unless your role has been granted write permission for the Search app. To do this, you or your admin need to navigate to Manager > Apps and click Permissions for the app to go to its Permissions page. On this page you or your admin can determine which roles have read or write access to the knowledge objects that the app contains. When your role has write permissions you can delete these knowledge objects. Write permissions also dictate which roles can set permissions for knowledge objects such as dashboards--if you don't have this ability that's a good indicator that you don't have write permission at the app level for your role. Second, you cannot delete default knowledge objects that were delivered with Splunk (or with the App) via Manager. If the knowledge object definition resides in the app's default directory, it can't be removed via Manager. It can only be disabled (by clicking Disable). Only objects that exist in an app's "local" directory are eligible for deletion. Hopefully this helps you out. For more information about knowledge object management see "Curate Splunk knowledge with Manager" in the Knowledge Manager Manual. ... View more

etc/system is not under the deployment server's control. The only thing the deployment server does is it pushes apps from its deployment-apps directory to deployment clients' apps directory (according to the rules set in serverclass.conf), so no other directories will have their contents modified. ... View more

Yes, but what do you do when you want to install across different environments? ... View more

I think I've figured it out. This is close to what I need: | search "BusyThreads*" "HandledRequest*" ... View more

You can add the field if needed.... http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ... View more