Ok good to know you figured it out. Please upvote the comment/answer useful for the final resolution of this. Thanks ... View more

@sgarvin55 -- is this fixed in the new 6.6 release? ... View more

As soon as I changed my DMC role to also be an indexer like you suggested it started working!!! ... View more

Thanks for your help ... View more

Thanks @polymorphic - going to use these to build out dashboards/alerts. Hoping in a future version of the Cloud Monitoring Console they may have something that warns/predicts of early data loss. ... View more

Hi many thanks for taking the time to reply to my post. Unfortunately the auditType!=FormSubmission element wasn't working, but please see my answer with the solution. Any yes 'subsearches' are a pain! Many thanks and kind regards Chris ... View more

Unfortunately, that isn't working for me. I'm on version 6.2.7. Could that be it? Also, I have a search cluster, could that be breaking this feature? In handler 'fvtags': Type = tags, Context = (user: username1, app: app_name, root: /dir1/opt/splunk/etc), Acting as = username1: Replication-related issue: Cannot move asset lacking a pre-existing asset ID: /username1/app_name/tags/host=hostname ... View more

This is now listed as an issue with a work around for the TA. http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Releasenotes ... View more

Fulfilled with shame I say thank you! ... View more

hi , in installing universal forwarder in search head ask me mngmnt port: and i set 8090 , now with netstat i get 8000 , 8089 , 8090 third of them are tcp , but i cant see ui of localhost:8000 , what should i do ? please help me please , please :((( i see apache 2 in lovalost , but with port 8000 no, what is my problem?can you help me? ... View more

Uh well, sort? http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort source="C:\\Data\\acctdata\\snm4-logger.log" "Customer has successfully retrieved file"| rex "::\s(?<timestamp>\S+)\s"| rex "^\S+\s(?<userid>\S+)\." | rex "\s(?<file_name>\S+)\s\((?<record_count>\d+)\srecords/(?<byte_count>\d+)\sbytes\)$"| stats count sum(record_count) as RecordCount sum(byte_count) as ByteCount by timestamp userid | sort - timestamp ... View more

Argh. I have been reading the XML over and over for those kind of mistakes... Pretty weird tho, that it worked in version 5. Thank you very much for your assistance. ... View more

you're welcome ... View more

In that case there isn't much you can do I'm afraid, thats imply how Splunk searches. stats last will be the best option if you're in a distributed environment. ... View more

As i said, VERY straight forward. 🙂 Thank you very much. ... View more