This is a known issue;  Splunk is currently working on improving this issue, no ETA, but expect to see improvements in a version > 10.0.  ... View more

I reached out to the development team and let them know your concerns, I have the same issue with an app I am developing as well. Not sure there will be any changes, but at least they know about it.  ... View more

Did you want to allow a user to see everything in CMC (e.g. data for other users?) I will let the CMC team answer the roles question, but many of the searches used in CMC currently require access. to the ~ internal ~ indexes (e.g. _audit) so users would need to have access to that data for all users, just something to keep in mind.  Would something like this work? https://ideas.splunk.com/ideas/EID-I-36 the idea proposed is having the ability for users to see their own data, but not others.  Then CMC could be written that users get access to the data that is relevant to themselves.  ... View more

Not supported by Splunk, but I use Fireshot plug-in for browsers (chrome/safari/etc), works well getting PNG/PDF for Splunk pages as well as other websites.. https://chrome.google.com/webstore/detail/take-webpage-screenshots/mcbpblocgmgfnpjjppndjkmgjaogfceg ... View more

Another option i was just made aware of that will work today: This will just create the file if you have > 5000 but less than <10000 events, but can be adjusted to whatever values make sense.  <populating search> | eventstats count as table_length | where table_length > 5000 and table_length < 10000 | fields - table_length | outputlookup create_empty=false lookup.csv   ... View more

Always consider creating an ideas post if you see something you want.  https://ideas.splunk.com/ideas/EID-I-1474   ... View more

This is sort of a known issue. What likely happened is you started a search, then changed tabs within a browser. . If you are getting this message, it is best to stay in the same tab and let the page load fully. This should help you a bit.  ... View more

Per https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/SearchTimeModifiers earliest=1 should be used. If you want to search events from the start of UNIX time, use earliest=1. When earliest=1 and latest=now() are used, the search runs over all time. ... View more

In a clustered environment it will be slightly different; index=_internal sourcetype=splunkd component=BucketMover "RemoteStorageAsyncFreezer freeze completed succesfully" (and yes, at least as of spunk 7.0.3.8 it is spelled incorrectly in the logs) 08-21-2018 14:42:09.186 +0000 INFO BucketMover - RemoteStorageAsyncFreezer freeze completed succesfully for bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955 8-21-2018 14:42:09.172 +0000 INFO BucketMover - RemoteStorageAsyncFreezer trying to freeze bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955, freezeInitiatedByAnotherPeer=true ... View more

This is a known issue for ITSI 3.0.X 2017-07-03 ITOA-8115 ITSI app throws Errors during installation ITSI components on License server http://docs.splunk.com/Documentation/ITSI/3.0.1/ReleaseNotes/Knownissues ... View more

This is now listed as an issue with a work around for the TA. http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Releasenotes ... View more

This is now listed as a known issue with the Unix TA. http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Releasenotes ... View more

Now there is a new option, $env:user$ Current user's user name https://docs.splunk.com/Documentation/Splunk/7.0.0/Viz/tokens There are some other useful tokens pre-defined by who is running the dashboard, most are available I think from 6.5+ Name Description $env:user$ Current user's user name $env:user_realname$ Current user full name. $env:user_email$ Current user email address. $env:app$ Current app context $env:locale$ Current locale $env:page$ Currently open page $env:product$ Current instance product type $env:instance_type$ Indicates whether the current instance is Splunk Cloud or an on-premises deployment $env:is_cloud$ Indicates if the current instance is Splunk Cloud. This token is only set when "true". $env:is_enterprise$ Indicates if the current instance is a Splunk Enterprise deployment. This token is only set when "true". $env:is_hunk$ Indicates if the current instance is a Hunk deployment. This token is only set when "true". $env:is_lite$ Indicates if the current instance is a Splunk Light deployment. This token is only set when "true". $env:is_lite_free$ Indicates if the current instance is using a Splunk Light free license. This token is only set when "true". $env:is_free$ Indicates if the current instance is using a Splunk Enterprise free license. This token is only set when "true". $env:version$ Current instance product version ... View more

I know it won't help anymore, but for reference: If you are having this issue you may have had a crash or non-clean shutdown and need to repair buckets. Please take a look at this wiki: https://wiki.splunk.com/Community:PostCrashFsckRepair "splunk fsck --all" should show you what buckets are bad, you can either remove them, or try to repair the bucket Useful options are: --include-hots, --log-to--splunkd-log & --ignore-read-error USAGE Supported modes are: scan, repair, clear-bloomfilter, check-integrity, generate-hash-files := --one-bucket|--all-buckets-one-index|--all-buckets-all-indexes [--index-name= ] [--bucket-name= ] [--bucket-path= ] [--include-hots] [--local-id= ] [--origin-guid= ] [--min-ET= ] [--max-LT= ] := [--try-warm-then-cold] [--log-to--splunkd-log] [--debug] [--v] fsck repair [--bloomfilter-only] [--backfill-always|--backfill-never] [--bloomfilter-output-path= ] [--raw-size-only] [--metadata] [--ignore-read-error] fsck scan [--metadata] [--check-bloomfilter-presence-always] fsck clear-bloomfilter fsck check-integrity fsck generate-hash-files fsck check-rawdata-format fsck minify-tsidx --one-bucket --bucket-path= --dont-update-manifest|--home-path= Notes: The mode verb 'make-searchable' is synonym for 'repair'. The mode 'check-integrity' will verify data integrity for buckets created with the integrity-check feature enabled. The mode 'generate-hash-files' will create or update bucket-level hashes for buckets which were generated with the integrity-check feature enabled. The mode 'check-rawdata-format' verifies that the journal format is intact for the selected index buckets (the journal is stored in a valid gzip container and has valid journal structure Flag --log-to--splunkd-log is intended for calls from within splunkd. If neither --backfill-always nor --backfill-never are given, backfill decisions will be made per indexes.conf 'maxBloomBackfillBucketAge' and 'createBloomfilter' parameters. Values of 'homePath' and 'coldPath' will always be read from config; if config is not available, use --one-bucket and --bucket-path but not --index-name. All constraints supplied are implicitly ANDed. Flag --metadata is only applicable when migrating from 4.2 release. If giving --include-hots, please recall that hot buckets have no bloomfilters. Not all argument combinations are valid. If --help found in any argument position, prints this message & quits. ... View more

There is a new version of the AWS app that supports the new AWS availability zone regions. Please check out Splunk app for AWS version 5.0.0 (https://splunkbase.splunk.com/app/1274/#/details) ... View more

Newer versions of Splunk offers the ability to have same checksum over multiple servers, so they won't reload every time they connect to new server. Check out serverclass.conf crossServerChecksum = true|false * Ensures that each app will have the same checksum across different deployment servers. * Useful if you have multiple deployment servers behind a load-balancer. * Defaults to false. ... View more

This is a followup on multiple timezones in SHC. It sounds like Lucas has his issue resolved, but the posting brought up some other questions that were deserving of clarification. Search heads in SHC ~need~ to all be on the same timezone to make things work right, UTC is always nice, but as long as they are in agreement it should be fine. Here is a scenario Search/report scheduled 2AM ( 0 2 * * * ), user is on a SHC where captain is in PST, so it will run at 2AM PST. If the captain fails at 1AM PST and goes to a captain in EST. The search will not run (since the time is already past as far as the captain is concerned). If it fails the other way EST->PST at 2:30am, will get it running twice. This is due to the fact that cron jobs are not timezone aware. As it was mentioned, if there is need to view data with different timezones, it should be done at the user profile level. ... View more