Hello sundareshr, thanks, this works. But depending on the search time range the subsearch can be quite slow. I think I need to find some optimizations for it. Regards, Thomas ... View more

Hi all, answered Tomasz question in a seperate section. I'm not able to post links yet... not enough carma but here my explanation: Are you running a distributed environment or a single one? Does your outputs.conf send all the data to the indexer? If yes, then there will be no local copy on the forwarder and thus the information is only available on the indexer. To enable the forwarder to see the data you will have to add it as a "search head". If you only have one indexer you can do this via GUI in the Settings > Distributed search > Search peers. Add here the indexer to the forwarder. If you have two indexers including the master node you will have to add both. The easiest way is to execute this command (adding the forwarder as searchhead to the master): $SPLUNK_HOME/bin/splunk edit cluster-config -mode searchhead -master_uri https://master_node_name:8089 -secret your_secret -auth admin:pwd Make sure not to add the forwarder to the search head cluster! Otherwise the data will now be replicated here aswell! I hope the solutions help you. Would like to know if it resolves your situation. ... View more

Yes, this works fine when the delete button is there. The problem arises when confs/dashboards are pushed from the Deployer to the default folder. In this case we need to delete on the Deployer shcluster/apps folder and then run splunk apply shcluster-bundle to delete the content from the search cluster. This is very similar to how the Deployment server works. Not terrible, just need to keep track of whether the content came from the UI or the Deployer to know how to delete. It gets more complicated when confs/dashboards were pushed via the Deployer and then a user goes in and edits the object via the UI. This is a very common scenario for apps downloaded from Splunkbase. In this case there are two versions of the object, one in default and one in local with the user updates and Splunk does not let you delete the local version via the UI when there is another version in the default folder. Also, I've tried via the REST API and I see the attribute "removable" set to 0 as in False. So ultimately you're left with the choice of doing everything via the UI or everything via the Deployer, or write scripts to clean up the mess until Splunk has better options via the UI. ... View more