I don't think that will give the same answer. After the timechart, you have a dc per minute, but you've lost what the dc for groupings of five minutes would have been. I wonder if this would be more efficient... index=httpd sourcetype=httpd-access | timechart span=1m values(clientip) as ips | streamstats dc(ips) as dc window=5 | fields - ips ... View more

Hi, See that stats command need _time field to get latest so if you have query like index=xyz | tabel t1, t2,t3 | stats latest(t1) by t2,t3 then you will see blank for latest(t1) column change query like index=xyz | tabel t1, t2, t3,_time | stats latest(t1) by t2,t3 | fields - _time OR index=xyz | stats latest(t1) by t2,t3 ... View more

splunk-base has a good pro and con list on this: http://splunk-base.splunk.com/answers/3890/pros-and-cons-external-lookup-script-vs-custom-search-command ... View more

If you look at what is actually stored in the summary index, you will get some hints about what will/won't work. I don't know that I understand the question properly, but here is an idea Use the following for the "populating search" or "summary query" host=*foo* status=200 authenticate POST email | sistats count by email Then see what you get. And I might have more suggestions if I really knew what you want - the email with the most events from the last 24 hours? Is "email" actually the name of a field? I assume so in the search above... ... View more

Success. The combination of INDEXED=true in fields.conf and FORMAT=newfield::"$1" in transforms.conf seems to do the trick. ... View more

This is possible to disable the global metadata since 4.3.3 And in Splunk 5.0 the global metadata are deprecated. To disable the Global Metdata and restore full speed indexing : Add option to indexes.conf that disables global metadata generation to handle deployments with rapidly growing sources.data file. (SPL-47689) The side consequence will be that the default summary page will not display values for the "last source/sourcetype/host". to apply, edit indexes.conf and add : disableGlobalMetadata = true see http://docs.splunk.com/Documentation/Splunk/4.3.4/Admin/Indexesconf ... View more

you could always just specify "| fields < all the fields that you want, comma separated >" ... View more

Perfect, thanks. I'd made my custom endpoint and setup.xml, but I didn't realize there was an app.conf setting for sending the user to the setup screen. ... View more

Hi AWED Go verify the capabilities of the user role .Because it can limit the action of user. you could go to Settings > Access control > Role and you will see Selected capabilities. For example Admin_all_objects capability mean that the user who has this role can manage all the objects. Tell me if it work like you want ... View more

I settled on the cli config lib (for the same purpose -- scripted inputs). No idea what the best practice is here, but I find this one to be very easy to use. I had a hard time understanding how to use readConf() myself... 😕 import splunk.clilib.cli_common config = splunk.clilib.cli_common.getMergedConf('myconfig') This just returns a normal python dict, so do whatever you want now. ... View more

That's a pretty common error in Python. If it's the only problem you're having it should be pretty easy to fix yourself. Based on a very quick look, edit webping.py and make the following changes: 1) In the line of imports in lines 3-4, change md5 to hashlib . 2) At line 107, change it to read: if (u.config['indexMD5'] and u.result.has_key('data')): s = u.result.get('data') h = hashlib.new('md5') h.update(s) checksum = h.hexdigest() print 'ping_md5 =', checksum A side effect is that you can replace 'md5' with 'sha1' or something else in hashlib.new() if you'd rather use a different hash algorithm. ... View more

Just wanted to say THANK YOU for this!! I've had this illegal cookie issue for MONTHS, and so far everyone I've bothered to help me looked at me like I have two heads... Firefox WORKS!!! 🙂 ... View more

https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Configurationfilechangesthatrequirerestart This works for me. ... View more

Releases are typically classified as major, minor and change. There are others, but I am guessing that Nick meant major version, which would be 5.0. ... View more

That would work. I wrote a "split" command to do effectively the same thing, and it has exactly the same problems. Deep suggested LINE_BREAKER instead of BREAK_ONLY_BEFORE. We're going to try that and see if the problem goes away. ... View more

Are you doing cross Unix-Windows deployment? I got this error before and discovered that if my DS is Windows and my DC is a linux, for example, you have to override these configurations: targetRepositoryLocation = $SPLUNK_HOME\etc\apps tmpFolder = $SPLUNK_HOME\var\run\tmp to targetRepositoryLocation = $SPLUNK_HOME/etc/apps tmpFolder = $SPLUNK_HOME/var/run/tmp I know this is an old question and you probably have figured it out but I thought it may be useful for other people who may have come across the same problem. ... View more

Correct. When you have a sid the job already exists, and the time arguments are set when the job is created. Hence you cant pass both sid and time arguments on the same URL (well you can but it'll ignore the time args) ... View more

I believe in Splunk 4.1 you can do: sourcetype=messages | eval f=id." ".parent | makemv f delim=" " | transaction f but that the transaction command in 4.0 and below won't do this. ... View more

If you have time it took to complete from a Splunk event you have _time which is the start time (epoch time, in seconds), so you have the end time, too. You may have to do some math from _time and the run time to get to end time, but once there, the above strategy will work for you. ... View more

Hi, I have a similar question. My inner search returns the date and time(for eg 06-22-2015-23). I want to use this time in my outer search as earliest time = "06-22-2015-23" and latest should be one hour after that(06-23-2015-00) i.e one hour post the earliest time. For eg. "outer search" [search ... | eval MyLatestTime=_time | fields + MyLatestTime | rename MyLatestTime as earliest] latest= earliest+1 Thanks in advance ... View more