did this ever get resolved?? ... View more

Agreed. It would be great to be able to have an option for time range of "automatic". If you then set the search to run every 10 minutes, it should set the time earliest time to -10m + max latency over the last period for the sourcetypes that will be used in the search. Splunk, can you make this a feature?? ... View more

As of Splunk 5.x it appears that max_searches_per_cpu=1 is the default due to the addition of good job queuing for GUI searches. See This answer for more details. ... View more

As of Splunk 5.x it appears that max_searches_per_cpu=1 is the default due to the addition of good job queuing for GUI searches. See This answer for more details. ... View more

Heh... just re-read my original question... seems I'm at the same conclusion I was when I wrote the question. External script would have to be the solution. ... View more

No, I never did. Splunk support was also unable to provide a way to do this. The only thing I can think to do is to custom-write a script that does the ldap query for you and modifies a regex in the splunk configs.... but last I knew there was no built in way to do this. However -- I haven't checked to see if this might have been a new feature in recent releases. ... View more

The official answer can be found here, quoted below: zoneinfo (TZ) database The zoneinfo database is a publicly maintained database of time zone values. UNIX versions of Splunk rely on a TZ database included with the UNIX distribution you're running on. Most UNIX distributions store the database in the directory: /usr/share/zoneinfo. Solaris versions of Splunk store TZ information in this directory: /usr/share/lib/zoneinfo. Windows versions of Splunk ship with a copy of the TZ database. Refer to the zoneinfo (TZ) database for all permissible TZ values. Unfortunately the Wikipedia page the docs link to is less than helpful as it doesn't actually list the acceptable abbreviations for each time zone. This article lists abbreviations and includes AKST... but it's still not clear if this list is one that Splunk considers valid. Since I'm running on linux, I decided to check /usr/share/zoneinfo/America/Anchorage. But that's not helpful either... it's a binary file. Searching the contents of $SPLUNK_HOME for some common timezone abbreviations led me to the file: $Splunk_Home/etc/datetime.xml ... whose header comment states: <!-- This file contains the general formulas for parsing date/time formats. --> Starting at line 49 it contains the following list: <define name="_zone" extract="zone"> <text><![CDATA[((?:(?:UT|UTC|GMT(?![+-])|CET|CEST|CETDST|MET|MEST|METDST|MEZ|MESZ|EET|EEST|EETDST|WET|WEST|WETDST|MSK|MSD|IST|JST|KST|HKT|AST|ADT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|CAST|CADT|EAST|EADT|WAST|WADT|Z)|(?:GMT)?[+-]\d\d?:?(?:\d\d)?)(?!\w))?]]></text> </define> So... I can't say for sure but it looks like this may be the list of timezones Splunk will automatically recognize??? I'll also submit feedback to the doc team asking for clarification and linking to this thread. ... View more

Could you post two (anonymized if you want) examples of the full event? One that does match condition 2 and one that doesn't? I'm not an expert on regex by any means but I'm confident that the placement of the presence of condition 2 in the event will effect the final regex format... ... View more

Adding the following (in hopes for more search result matches): This is the URI we are referring to... dj/en-us/splunk_app_windows_infrastructure/ad/sec_admin_audit/ The path to access via gui is: Splunk App for Windows Infrastructure --> Active Directory --> Users --> Administrator Audit. ... View more

Same problem here... ... View more

I had the exact problem specified in the original question, and added full write access recursively to /opt/splunk/etc/apps/framework for the 'splunk' user. Now I don't get the 404 error but I get: "Error: AttributeError at /en-us/splunk_app_windows_infrastructure/" Any thoughts? ... View more

Have you deployed the TAs for active directory monitoring? Specifically: TA-DNSServer-NT5 TA-DNSServer-NT6 TA-DomainController-2012R2 TA-DomainController-NT5 TA-DomainController-NT6 (as appropriate) ... View more

Re: using an alternate domain-specific attribute for the user name: This would require significant effort on the AD side to ensure that unique attributes exists for each user in question. It may be our only option, though. ... View more

In an AD environment you can specify a domain to attempt to log in to by entering the username in the format "DOMAIN\ussername" or "username@DOMAIN". I was hoping that Splunk could be configured to accept the same format. ... View more

Working with Splunk support, it appears that there is no way to specify the domain when logging in. Instead, you must find an alternate 'user' attribute to match on, and the attributes must be unique between the two domains. ... View more

I'll award this as an answer because it is a successful workaround. However, I feel this should be part of the basic GUI functionality -- end users should not have to learn to write/manipulate Splunk searches to create custom dashboards to be able to schedule a pre-build dashboard for delivery with their specific options selected. ... View more

Looks like this is the fix. I'll contact the docs team to get them to make a note in the docs about this. ... View more

Doesn't seem so, unless you care to rewrite the summary indexing portions of the app/addon... ... View more

Turned of UAC, attempted installation: got the same error message. ... View more

I am also looking for a solution to this problem. Creating separate dashboards for individual user reports is only feasible for a very small number of users. ... View more

I had a similar issue on CentOS 6.4 (minimal install). Resolved it by running yum install firefox This installed tons of dependencies 39 dependencies plus firefox (40 packages in all). After this, the "included" version of firefox that pdfserver uses was able to run and generate reports. ... View more