@ptoro any recollection what LDAP related messages you were seeing on your indexers? I have a bunch of "user=xyz not found" but I doubt that's a big deal... ... View more

What was the solution here? I'm having a similar issue with a similar approach. ... View more

What about restructuring your search so it's something like this format? index =indexA sourcetype=sourcetypeA index=indexB sourcetype=sourcetypeB | transforming commands |appendcols| putitalltogetheretc If that's accelerated, all of the data is being pulled before the first transforming command so it should be fast. ... View more

Trying to get a handle on what "generate a remote timeline" means-- what's the effect of disabling this? ... View more

I'm trying to do something very similar, and trying to optimize my search-- Over the timeframe of 24h, I hit the subsearch limits. Using a smaller 2hour timeframe, I see the difference is something like 5 ips after subsearch filter, vs. about 1,130,000 ips using the dc(index) model-- after which I am splitting all of those by about 10 different parameters and it takes forever to calculation on all of them. Any suggestions on how to improve this? My current search format is: ` (index=a sourcetype=b ) OR (index=c sourcetype=d action=e) | eval ipv4=coalesce(ipv4, pattern) | eval DISTINCTLOCKOUT=if(statement) | eval DISTINCTELOCKOUT=if(statement) | eval impacted_username=if(statement) | eval whitelisted_username=if(statement) | eval Date=strftime(_time, "%Y/%m/%d") | eval failed_name=if(activity_status=="FAILED" AND activity_error!="7577",username,NULL) | eval success_name=if(statement) | eval blocked_name=if(statement) | stats count as TOTAL_COUNT, count(this) as UNBLOCKED_TOTAL, count(this)) as BLOCKED_COUNT, count(this)) as WHITELISTED_COUNT, dc(this) as UNIQUE_WHITELISTED, count(eval(activity_status=="SUCCESS")) as SUCCESS_COUNT, count(eval(activity_status=="FAILED" AND activity_error!="7577")) as FAILED_COUNT, count(eval(this and isnull(that))) as IMPACTED_COUNT, dc(this) as UNIQUE_IMPACTED, count(eval(this OR that)) as LOCKOUT_COUNT, count(eval(this OR that OR that)) as ELOCKOUT_COUNT, count(eval(this OR that OR that)) as RANDOM_USER_LOGINS, dc(username) as UNIQUE_USER_COUNT, dc(failed_name) as FAILED_UNIQUE, dc(success_name) as SUCCESS_UNIQUE, dc(blocked_name) as BLOCKED_UNIQUE, min(_time) as FIRST_TIME, max(_time) as LAST_TIME, min(eval(if(statement))) as BLOCKED_TIME, dc(DISTINCTLOCKOUT) as "DISTINCTLOCKOUT_COUNT", by ipv4 | some prettyprint stuff ` Thanks in advance for any pointers. ... View more

Sounds like a good candidate for a daily summary. This way, you would have one value per day (or one value per hour) --or several values such as avg, max, min, etc.--depending on the level of granularity you want. This could make it easy to see a larger (yearly) timeframe. http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Usesummaryindexing ... View more

I am having this issue as well. It's on a SH which has some very full parsing queues. The other SHs on my Search Head Pool do not have full queues at all. All my Indexers' queues are all clear. Suggestions on where to look next? ... View more

I am trying to do a similar thing here-- simply draw a line across my graph showing a "full_capacity" line. I've tried mysearch | eval capacity=100 | stats max(capacity) to no avail. Also capacity=tonumber(100) is no different. A new way to do this? Alternatively, to clearly label the top of my chart's Y-axis? Choosing the value in the dashboard UI doesn't label the top. Thanks! ... View more

Thanks for the tip! I think it's a bit different what you were seeing-- where you see no clients phoning home (if I understand correctly). What you get if your mess up your sc.conf is a completely blank Forwarder Management page-- no columns or anything. ... View more

Were you using the CLI to edit your serverclass.conf? I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf that is not supported in the UI. I have also seen this issue when specifying a default value explicitly (restartSplunkd=false for example-- bc/ that is the default). You can also check to make sure that all the Apps you have specified to be deployed in your serverclass.conf actually exist in the SPLUNK_HOME/etc/deployment-apps directory . ... View more

Were you using the CLI to edit your serverclass.conf? I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf that is not supported in the UI. I have also seen this issue when specifying a default value explicitly (restartSplunkd=false for example-- bc/ that is the default). You can also check to make sure that all the Apps you have specified to be deployed in your serverclass.conf actually exist in the SPLUNK_HOME/etc/deployment-apps directory . ... View more