This is old article, but I still add one comment how I'm doing it if possible (little bit modified version from @gjanders ' own method). I have plain app from splunkbase without any inputs. Then separate apps like 0xy_<splunkbase_app> for all needed separate configurations and join these into serverclasses. r. Ismo ... View more

@tpeveler_splunk How does one re-index the dumped events? ... View more

Did you ever manage to get a solution to this? I can also get the sessionKey with  auth.getSessionKey('admin','<password for admin>') but I also don't want to hardcode the password.  ... View more

Following is an example (untested but you should find working examples on Splunk Answers) of using map command to get email from lookup based on current day and pass on the to the sendmail command. | inputlookup test.csv where [| makeresults | fields - _time | eval Days=strftime(now(),"%a") | table Days] | table email | map search="index=_internal sourcetype=scheduler savedsearch_id= status= skipped | stats count by reason| sendemail to=\"$email$\"" Refer to answer from @woodcock for using map command for sending email with context : https://answers.splunk.com/answers/399434/send-emailed-results-to-an-email-address-in-the-re.html#answer-399515 ... View more

Here is an approach that uses an eval statement with a subsearch to get the overall number of hosts to use in the foreach statement that calculates the percentage. I also included limit=0 in the timechart command so that all hosts are included in the results. index=main host=hosts0*p "serviceAvailable=true" | timechart limit=0 partial=false span=15m count by host | eval numhosts= [ search index=main host=hosts0*p "serviceAvailable=true" | stats dc(host) as numhosts | return $numhosts ] | foreach hosts0*p [ eval <<FIELD>> = '<<FIELD>>' * 100 / ( (15 * 60) / (10 / numhosts ) ) ] ... View more

Hello, The most straight forward way to handle this would be to use the top command. A couple of things to note. You'll want to wildcard your sourcetype so that you do indeed pickup the wineventlog sourcetypes (i.e. sourcetype="wineventlog:*"). In addition, you'll want to wrap the OR condition on the Type fields in parenthesis as such (Type="Critique" OR Type="Avertissement") SPL... index="wineventlog" sourcetype="wineventlog:*" SourceName="" (Type="Critique" OR Type="Avertissement") | dedup _time SourceName | top limit=10 SourceName ... View more

A Splunk implementation requires a default minimum free disk space of 5000MB for indexing. In your case it looks like the minimum free disk space limit may have been changed to a higher value. Check out the following two options to address the errors and enable your searches to return results: 1) Add space to the file system that houses Splunk (i.e. /opt/...) 2) Decrease the minimum free disk space limit. See http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Setlimitsondiskusage for details on how to set limits on disk usage. I had a customer that was experiencing the same issue as yours and we were able to address it by implementing option 1 (add space). ... View more

mbrunetto - see https://answers.splunk.com/answers/310035/how-to-connect-a-search-head-to-an-indexer-via-pro.html as to why this doesn't work. ... View more

(I'm pretty sure) We've done it without giving users admin_all_objects - we just made all the artifacts in the jira alerting app world readable, and we use an account to post into jira that's only allowed to post into jira and nothing else. Our jira projects are independently permissioned. ... View more