Hi there,   It should work with IP addresses, if your data is going through an HF before reaching an indexer then the config should be applied on the HF.   Let me know if it works for you!   Cheers, David ... View more

Help vote up these new feature ideas ..   which is for Splunk to create an app or feature within to product to schedule reoccurring disablement of certain scheduled searches/alerts/reports. https://ideas.splunk.com/ideas/EID-I-181 https://ideas.splunk.com/ideas/EID-I-654   ... View more

Awesome search!     Thank you VERY much.  ... View more

A non-fixed time frame and a schedule PDF don't really make a lot of sense together. So the solution is, sort of like you've started to discover, to remove the timepicker and all things associated with it (and other inputs). A help may be to do what I do in these cases: Clone that dashboard, on the clone's name put "static" or something so you know it's no longer selectable. And yes, then go through and reset all the searches to not use the time pickerm, give them each a specific time frame, and *adjust the title* of the chart to reflect that timeframe.  "Sales for previous week".  Remove any other tokens. Then remove all the inputs and whatnot. When you save it, it should now be schedulable. (Though I'd LOVE to hear someone with a better answer.  Maybe you should go to ideas.splunk.com and ... well, search first to see if someone's already asked for this, but if not - maybe create an idea asking for this?) ... View more

You don't need control over the inputs.. I'm assuming your the Splunk admin, so you have to control the Splunk conf files. I don't see why it's so difficult to create an additional sourcetype or add this to existing sourcetype. ... View more

I think if you use the trigger condition or a where clause to filter out the data you want, you might also want to look at eventstats. index= source= host="something*" | eventstats distinct_count(host) as distcounthost | where distcounthost > 1 Would for example add the "distcounthost" to each event but not lose the raw data, so you won't need a map or a report + alert... ... View more

I did not find a resolution to this, so as a work around to push through the app certification process I commented out all the references to email alerts and actions. ... View more

On linux that would be: index=_internal source="/opt/splunk/var/log/splunk/python.log" sendemail ... View more

for disabling/enabling an alert, no not at all. ... View more

Anyone try this on db connect 3.30? ... View more