Hello, I'm stuck. I can't get a simple alert against the source=WinEventLog:Security to send me a CSV file. This is on Splunk Enterprise v 6.3 The search that I am trying to do is simple source=WinEventLog:Security | stats count by host For this test, I have it set up to run as a cron every 5 minutes, with the checkbox set to create a CSV and email it to myself. It runs as expected. I can view the results in the *Triggered Alerts * and see that it creates 124 lines that look like host count XX-APP01 31 XX-APP02 25 etc However, no CSV is emailed to me. Looking in python.log, sendemail does not generate an error message When I change it to send a PDF via email, or show the results in-line via email, the email arrives within 10 seconds of the job running, with the 124 lines displayed. Based on this, I don't believe it is an email issue. Can't figure out why a simple CSV will not be generated and emailed. What (or where) should I look next? Is there some Splunk config switch that I need to turn on (or off)? ... View more

Hello everyone, We have a dashboard that displays the number of transactions for the day, as a single value panel. The search is very simple and easy as each transaction is a separate event in the log: index=my_index category=transaction | stats count The dashboard refreshes every 5 minutes. Which means that Splunk recounts them every 5 minutes to come up with the new count. What happens is that during our busy time of the year, the number of transactions arriving exceed 5 minute refresh time it takes Splunk to finish counting them. What I would love is for Splunk to “remember” the last count of transactions (say it was 7,500,000) and start counting from there. That way, the count is accurate, and the Splunk processing is not as great (hopefully). I just don’t know how to do that, or if it can be done. Any ideas? ... View more

Pretty sure the title says it all. Using Splunk Enterprise, if that makes a difference. ... View more