As not all instances allow for CLI access, such as Splunk Cloud, you may also query the captain from the Search GUI. | rest /services/shcluster/status splunk_server=local | fields captain.label ... View more

I just created this Splunk Idea, if everyone would please vote on it! https://ideas.splunk.com/ideas/CONNID-I-22 ... View more

This is true for Splunk Enterprise. Splunk Cloud does not have a timeline for this support. ... View more

Worked great for me! This is also Splunk Cloud friendly, as we do not have access to the configuration directly. ... View more

Our or is also dependent on SAML only, and this limitation makes Mobile unusable. Would love to know when this will be fixed. ... View more

I had great success with the following: Service service = getSplunkService(); String dashboardName = "rest_dashboard"; String dashboardXml = "<dashboard>\n" + " <label>temp</label>\n" + " <row>\n" + " <panel>\n" + " <chart>\n" + " <search>\n" + " <query>index=_internal\n" + " | timechart count</query>\n" + " <earliest>-1h@h</earliest>\n" + " <latest>now</latest>\n" + " <sampleRatio>1</sampleRatio>\n" + " </search>\n" + " </chart>\n" + " </panel>\n" + " </row>\n" + "</dashboard>"; JobArgs jobargs = new JobArgs(); jobargs.put("name", dashboardName); jobargs.put("eai:type", "views"); jobargs.put("eai:data", dashboardXml); String endpoint = String.format("/servicesNS/rest_user/app_name/data/ui/views/%s", dashboardName); service.post(endpoint, jobargs); ... View more

See https://answers.splunk.com/answers/223655/can-i-export-pdf-via-rest.html ... View more

I'm looking to have a panel with an inline search with an ID. Save that panel as a Prebuilt Panel. Use that panel in a dashboard, and have other Prebuilt or Inline panels reference the first search as a base search. Looking to keep things DRY. ... View more

It appears you can use tokens in prebuilt panels, but not pass specific parameters. Example prebuilt panel XML <panel> <table> <search> <query>index=_internal source=*splunkd.log data_host=$host_pattern$* data_sourcetype=$source_type_pattern$ ... View more

I WISH there was a way to create a prebuilt panel and reference its Search ID in additional panels, but I don't believe it is possible. You can create a report and reference the same report in multiple prebuilt and inlined panels. ... View more

Saving a prebuilt panel with a search with an ID works fine. However, I am not able to reference the base search in any other panels. The search does not support a ref . <panel ref="base_foobar"></panel> <panel> <event> <title>child panel</title> <search base="foobar_search_id" > </search> </event> </panel> ... View more

In 7.3, there is now an "Expires" field which can be set in the simple Edit Alert interface. The "Expires" value is only used to determine the TTL when using the "Add to Triggered Alerts" Action Type. ... View more

Job artifact retention is controlled by the "dispatch.ttl" setting. https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Savedsearchesconf Indicates the time to live (ttl), in seconds, for the artifacts of the scheduled search, if no actions are triggered. If an action is triggered, then it is based upon the configuration for that action. For example if we alert our DevOps group, we want the job to be retained for a minimum of three days, to allow for low-priority job review after a weekend. ... View more

Best practice is to return using the '$' dollar symbol before your field name | return $field_name at the end of your SubSearch. This will return just the values, and not the field name. index=myindex [ index=myindex host=myhost MyName | top limit=1 clID | fields + clID | return $clID ] (clID=val1 OR clID=val2 OR clID=val3) becomes (val1 OR val2 OR val3) ... View more

Yes, you may use a REST call to delete. See DELETE for the "saved/searches/{name}" endpoint. https://docs.splunk.com/Documentation/Splunk/6.5.1612/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D Please keep in mind that the Splunk Search interface command line provides a 'rest' command, but this is read only, and is not a true REST client. Please use your favorite common purpose REST client. (curl, Postman, any HTTP library) ... View more

I am a Splunk Cloud customer who can not make configuration changes directly. I was able to work around this by adding the backend collection via REST: curl -k -u <username>:<password> -d name=<collections_name> https://<youraccountname>.splunkcloud.com:8089/servicesNS/nobody/<app-name>/storage/collections/config ... View more

Splunk has provided a simple example in the form or a Curl Statement curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/data/ui/views -d "name=new_dashboard&eai:data=<dashboard><label>the_new_label</label></dashboard>" Taken from: http://docs.splunk.com/Documentation/Splunk/7.2.0/RESTREF/RESTknowledge#data.2Fui.2Fviews ... View more

FYI - "Do not use crcSalt = with rolling log files, or any other scenario in which logfiles get renamed or moved to another monitored location. Doing so prevents Splunk Enterprise from recognizing log files across the roll or rename, which results in the data being reindexed." From: http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Howlogfilerotationishandled ... View more

Please see the Splunk Documentation for "Generate PDFs of your reports and dashboards". http://docs.splunk.com/Documentation/Splunk/7.0.3/Report/GeneratePDFsofyourreportsanddashboards Excerpt from documentation: limits.conf In the [pdf] stanza you can set the max_rows_per_table to set the maximum number of table rows that Splunk software will print out for simple results tables in a PDF. The default is 1000. Note: This can lead to multi-page reports if your tables have lots and lots of rows. Reduce this number if you want to limit the number of pages that a table can generate for a PDF version of a dashboard. ... View more

Splunk Cloud does not allow us to Enable/Disable an application without a support ticket. Our use case does not have a predefined window, but needs a control by a user. We can accomplish this using a search Macro. 1) Include your macro at the end of each related search. Ex: " should_run " 2) To enable the search define the macro to be: | noop 3) To disable the search define the macro to be something like: some_really_invalid_key="this will never be found" ... View more

This may be helpful: https://answers.splunk.com/answers/366832/generate-pdf-from-view-in-rest-api.html See also "scheduled/views" in http://docs.splunk.com/Documentation/Splunk/6.6.3/RESTREF/RESTlist ... View more

I had the same problem, and I discovered that the same GUID was being sent by multiple Deployment clients. This is because we use AWS AMI's and the ID file is part of the common configuration. I had to update our install scripts to remove the /opt/splunkforwarder/etc/instance.cfg file. When Splunk starts up, it is recreated automatically. See also: https://answers.splunk.com/answers/542872/what-do-i-look-at-in-splunkdlog-to-troubleshoot-de.html ... View more

I use the following alert to determine if our queue size is too large, over a 15m period. index=_internal source=*metrics.log host=sh*.ourCloudName* | stats avg(current_size) as avg_queue_size by host | search avg_queue_size > 1000 Be sure to fixup the actual host value. ... View more