Is it possible to check the current status of the execution of backfill_all.sh? Is there any possibility to see the progress in the web intelligence user interface to estimate the remaining execution time? Thank you. ... View more

I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks. ... View more

Search fails to correctly return all matching events when performing outer joins. The search below illustrates the problem (only one row is returned): | head 1 | eval somefield="matchthis" | stats count by somefield | join type=outer somefield [ search * | head 10 | eval somefield="matchthis" | eval joined="success" | fields + somefield,joined ] The first search creates a field call "somefield" that ought to be matched within the sub-search. The sub-search returns 10 matching events and therefore the results ought to include all 10 events from the sub-search. The search does return an event that matches (indicated by the fact that the field "joined" is returned with a value of "success") however, only one event is returned: | somefield | count | joined | 1 | matchthis | 1 | success | Is this correct? ... View more

I want to upgrade a Splunk device version 3.4.5 build 47883 to version 4.0.11 build 79031. Can I do a direct upgrade or do I need to upgrade to an earlier version of 4.0.x first? ... View more

I have some question about auto_pause. I can use via input the "auto_pause=true" in the URL when I search like "https://192.xxx.xxx.xxx:8000/en-US/app/search/flashtimeline?auto_pause=true&q=search%20index%3D*" and I must to do every time when I want to use auto_pause function. But now I want to auto pause the search without inserting "auto_pause=true" how can I do that? How can I configure my splunk server to auto pause without user's input "auto_pause=true" in the URL. Please tell me how to set my configure files to solve this. ... View more

I find the document about auto finalize in this page http://zh-hant.splunk.com/base/Documentation/latest/Developer/RESTSearch. I use the parameter auto_finalize_ec = integer like "https://splunk-server:8000/en-US/app/search/flashtimeline?auto_finalize_ec=5000&q=search%20index%3D*" and it does not work. But when I use the parameter auto_pause in the same document like "https://splunk-server:8000/en-US/app/search/flashtimeline?auto_pause=true&q=search%20index%3D*" I works. Please tell me, why it's not working and how can I do it to work. ... View more

We have many hosts running backups every night and report back if they are successful or not. I would like to simplify the report the search produces so that it easier to read. What should I change in my search to get my preferred output? Thank you! Splunk events of both types of events: Jun 2 21:04:55 xx.xx.13.123 Jun 2 21:04:52 xxx-app-03 ntbackup[info] 8019 End Operation: The operation was successfully completed. Consult the backup report for more details. Jun 2 21:04:52 xx.xx.13.172 Jun 2 21:04:48 xxx-2 ntbackup[error] 8019 Warnings or errors were encountered. Current Search we are using: "EventCode=8019" OR " 8019 " starthoursago="24" | fields + host | eval status = if(_raw LIKE successfully, "OK", "Backup Failed") Current Output: _time host status _raw 1275451893 xx.xx.13.20 Backup Failed Jun 1 23:11:33 xx.xx.13.20 Jun 1 23:11:31 host-PROC ntbackup[info] 8019 End Operation: The operation was successfully completed. Consult the backup report for more details. Preferred output: Date Time Host status 6/1/2010 23:11 host-PROC OK ... View more

I am attempting to use the real time view over time. It stops displaying events that are happening and hangs...the time it takes to hang after starting the view can range from minutes to hours. There is no indication of a problem. In fact everything appears normal, just no events are showing up. A non-real time search will show the missed events. The user restarts the real time search and it works for a while and then stops displaying events again... Is there a setting to increase the expiration time for real time jobs? Thank you! ... View more

I need to add something to the following string (or rewrite it) that captures users sum by url by date. Any help would be appreciated. host="192.xxx.xxx.xx" Prism http://host1.com:80//Citrix/MetaFrame action="POST"| stats count by user, dest_url Thank you! ... View more

The first search (1) will return host values and time values. Need to have those values used in another search (2) search earliest=5/2/2010:18:00:00 latest=5/3/2010:18:00:00 | bucket _time span=10s | stats count(domain) as domain_count by _time host | autoregress domain_count p=1-5 | where domain_count/domain_count_p1 < .10 I get all kinds of errors when running the below search .. I just do not know how to get the outside search to use the returned time and host values from the sub search. search earliest =-60m latest=_time host=host | " some other splunk stuff " [ search earliest=5/2/2010:18:00:00 latest=5/3/2010:18:00:00 | bucket _time span=10s | stats count(domain) as domain_count by _time host | autoregress domain_count p=1-5 | where domain_count/domain_count_p1 < .10 | fields _time, host] ... View more