Hi here is my old answer https://community.splunk.com/t5/Monitoring-Splunk/How-do-I-export-all-alerts-to-csv-or-pdf/m-p/629226#M9319 r. Ismo ... View more

Too many events (100K) with the same timestamp: incrementing timestamps 1 second(s) into the future to insure retrievability   Even I am having the same error but my data does not have a timestamp in the event, so I kept it to DATETIME_CONFIG=CURRENT .  How do I overcome this error ?      ... View more

It was not really removed but it did get modified to be user-configurable (with a very small default). This is indeed a welcome improvement. ... View more

This only applies if your object does not already have an owner= defined. In your case (actually, in every case where a knowledge object has been created or modified from the GUI), it already has it's own value so it will not inherit the default value that you have defined in local.meta . The way that this works is, as an app developer (do not over-glorify app ; this just means a packaging of configuration files to be deployed together), I can dispense with putting an owner=newowner line under every Knowledge Object definition and instead put owner=newowner once inside of local.meta . If Splunk does not find an owner= line in the Knowledge Object definition stanza, it will use the one from local.meta (if it exists). ... View more

Hi all, answered Tomasz question in a seperate section. I'm not able to post links yet... not enough carma but here my explanation: Are you running a distributed environment or a single one? Does your outputs.conf send all the data to the indexer? If yes, then there will be no local copy on the forwarder and thus the information is only available on the indexer. To enable the forwarder to see the data you will have to add it as a "search head". If you only have one indexer you can do this via GUI in the Settings > Distributed search > Search peers. Add here the indexer to the forwarder. If you have two indexers including the master node you will have to add both. The easiest way is to execute this command (adding the forwarder as searchhead to the master): $SPLUNK_HOME/bin/splunk edit cluster-config -mode searchhead -master_uri https://master_node_name:8089 -secret your_secret -auth admin:pwd Make sure not to add the forwarder to the search head cluster! Otherwise the data will now be replicated here aswell! I hope the solutions help you. Would like to know if it resolves your situation. ... View more

Thanks Pablo! ... View more

Clean the sos lookups, and next time it's re-populated, it should refresh the list of forwarders. ... View more

For this sort of urgent issue, it's probably better to call support... I'm not seeing which version of DB Connect or Splunk you're using, which would definitely affect the potential answer. ... View more

@markthompson @ngatchasandra @ppablo_splunk When I make changes to a report, alert's query on splunk, the save option remains greyed out, so every time I have to save the report/alert as a new one using the 'save as' option. A while back I had asked this question to the community and was told that my role should have the 'list_inputs' capability. I remember adding that capability to the admin role and for a while the save option worked fine. Off late, the save option has gone back to being greyed out and i looked to perform the obvious step of adding the 'list_inputs' capability. Like @ngatchasandra said, I too can see the particular capability in imported capabilities list, but since the save button isn't working, one can deduce that the capability isn't performing as expected. Any inputs? ... View more

I am getting this with the docker container version of the splunk forwarder. I'm struggling to find a proper and consistent fix. ... View more

I encountered this error after connecting LDAP. Splunk added the role "exchange-admin" to the admin profile, but this role did not exist. I created a role with the same name and the issue was resolved. ... View more

Yes you can do from backend in Splunk search head server Need to move Dashboard xml file in splunk/etc/apps///data/ui/views And update default.meta file under /metadata/default.meta file as [views/XXXXXX_dashboard] access = read : [ user], write : [ poweruser ] export = none owner = XXXXX version = 6.5.1 modtime = 45356436543674 ... View more

If obects like reports/alerts/dashboards are available across all search-heads in a pool, isn't it logical to assume that so would be the users? But they are not! (On 6.2.2) ... View more