We are trying to create a table view of some event log messages, however some of the event log messages are very long and require a lot of horizontal scrolling to read. We'd like to be able to view the message field all at once, by doing something like having double or triple height rows or word wrap in some way. Is there anyway to do this? ... View more

Using the new report acceleration feature, I'm only getting "There are no report acceleration summaries." message on the summary page where I would manage the report accelerations. This page: http:// /en-US/manager/system/summarization I have checked the box for accelerate search for a few saved searches so there should be something in there. It was working before, now I get nothing, any ideas? ... View more

I'm trying to get Thursday of this week compared with Thursday of last week and have the values overlay in a stack graph. Using the following search, based off this link, I'm not able to get the data to overlap I can only get it working side by side. source="Perfmon:CPU Load" counter="% Processor Time" host="SERVER01" earliest=-1d@d latest=-0d@d | eval ReportKey="this week" | append maxtime=600 [search source="Perfmon:CPU Load" counter="% Processor Time" host="SERVER01" earliest=-8d@d latest=-7d@d | eval _time=_time+60*60*24*7 | eval ReportKey="last week"] | timechart span=5m avg(Value) by ReportKey What am I missing? Splunk Version 4.3.3 ... View more

We started our setup with a standalone Splunk server. Now that we have a second standalone Splunk server next to it, we'd like to share the load across both machines. We'd prefer to do this in a way where we don't have to share an index between the machines, for the least amount of disruption to users. What would be the best way to go about this? ... View more

When I install the universal forwarder on a Windows server via the GUI, I have the option to add inputs with check boxes, like Perfmon monitors, Event logs, and folders. However, when I go to: "C:\Program Files\SplunkUniversalForwarder\etc\system\local" I don't see any of those options I've selected previously saved in the configs there. Where are they saved to and what is the best way to change the options I selected at install? ... View more

Splunk is not removing commented out fields beginning with a "#" in indexed IIS logs. Any assistance would be greatly appreciated. I've added the following to my configs: props.conf: [iis-2] pulldown_type = true MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = False CHECK_FOR_HEADER = False TZ = GMT REPORT-iisw3cfields = iisw3cfields TRANSFORMS-removecomments = removecomments transforms.conf: [removecomments] REGEX = ^\#.* DEST_KEY = queue FORMAT = nullQueue Sample log comments: #Software: Microsoft Internet Information Services 6.0 #Version: 1.0 #Date: 2011-11-08 00:00:43 #Fields: date time s-computername s-ip cs-method cs-uri-stem cs-uri-query cs-username c-ip ... View more