you can easily create that table by following these steps: compute the Message Size field and create the ranges you like create another field for the columns you need to have (below I assume you already have it and it's name is log_level) use the chart command to generate your table Here's an example: .... | eval ms=len(_raw) | eval MessageSize=if(ms<100, "0-100", if(ms<200, "100-200", ">200")) | chart count over MessageSize by log_level ... View more

I basically disabled all apps: splunk disable app <appname> (even SplunkForwarder & SplunkLightForwarder ) Note: Somehow, I couldn't disable eg. the search app! With command splunk btool [inputs|outputs] list --debug , I could see paramaters Splunk's using while running. I noticed the search app's beeing used with a no-good inputs.conf file for me - so I removed that inputs.conf , since I couldn't disable the app itself. Furher, in $SPLUNK_HOME/etc/system/local , I edited inputs.conf & outputs.conf as followed: inputs.conf [splunktcp://:25000] outputs.conf [tcpout] defaultGroup = indexserver.com_25000 disabled = false indexAndForward = 0 [tcpout:indexserver.com_25000] autoLB = true server = indexserver.com:25000 ... View more

I didn't find a simple command, but these are quite good too splunk btool inputs list --debug splunk btool outputs list --debug ... View more

Here are some links to (maybe) similar problems - does one refer to you?! http://answers.splunk.com/questions/2736/lookup-table-does-not-exist-error-on-update-to-4-1 http://answers.splunk.com/questions/10630/splunk-says-lookup-table-doesnt-exist-but-it-does http://answers.splunk.com/questions/6643/hostname-table-lookup-not-working-whats-the-issue http://answers.splunk.com/questions/1716/error-in-lookup-command-the-lookup-table-test-lookup-does-not-exist ... View more

use splunk to call btool, the library will be the splunk ones, not the system ones. by example, to check the list of the inputs cd $SPLUNK_HOME/bin ./splunk cmd btool inputs list --debug ... View more