I'm trying to figure out where the app content is served from in a distributed deployment. For example, is the entirety of each app stored on every server in the deployment, or is it served from a single location?  Specifically I have two questions - if you want to edit app dashboard or JavaScript files using a text editor, rather than the the GUI, can you do that in a distributed environment? If so where would you do that? ... View more

I'm posting this question mostly because it's maddening. I want a dashboard that is shared between two apps to behave differently based on the value of $env:app$. Doesn't work: <init> <eval token="isMyApp>if($env:app$=="myApp", "true", null())</eval> </init> If I run a search as follows: <search> <query>| makeresults | eval foo = if($env:app|s$=="myApp", "true", null())</query> <done> <set token="showMyAppPanels">$result.foo$</set> <eval token="iAmBroken">if($env:app|s$=="myApp", "true", null())</eval> <eval token="meToo">if($env:app$=="myApp", "true", null())</eval> </done> </search> The $result.foo$ evaluates correctly but the other two return null regardless of the value of $env:app$ . So with $result.foo$ , or some JS I can get where I need to be, but why does it take running an extra search or script to get there? ... View more

Using SplunkJS, I would like to pass a data object to a search manager so that it can be displayed in a visualization. Basically I have a complex search that stitches together the state changes experienced by a UID to calculate the duration of each state and provide a timeline. I want to be able to visualize the data from 10 separate UIDs at a time. I have found that it's much more performant to gather each of the 10 results arrays separately and then aggregate them than it is to use other solutions I've explored (e.g. using | append). Once I have the data object that is the aggregate of the 10 results, is there a way to pass that to a search manager and visualization? ... View more

Is there a way to set another user's timezone from the REST API? My user account with edit_user capability cannot change the timezone of other users, although I can update roles, change passwords, etc. If i try to update another user's timezone setting I see "Argument 'tz' is not supported by this handler" while the same call will work for the user account that is issuing the REST call. While this does kinda seem like a bug, is there a known workaround? I am able to do it with capability admin_all_objects, but don't want to do that for security reasons etc. ... View more

Has anyone seen an issue where an accelerated data model has duplicate events in tsidx files? Occasionally I encounter an issue where there are many more records in the accelerated data model compared to the corresponding index data. I get the data model event count using | tstats count from datamodel=<datamodel> by _time And also see the high count in the pivot GUI. Rebuilding the data model will correct it so that the event counts match. I'd like to be able to prevent this from happening or at least understand why it occurs. Around the time that the data model gets 'corrupted', I've noticed a lot of sourcetype=splunkd_access events are generated with a URI that looks like this: /servicesNS/user1/myapp/admin/summarization/tstats%3ADM_myapp_mydatamodel/touch The user1 in this URI has limited permissions. They have access to accelerate_search but not to schedule_search which I think is is required for accelerate_search to be truly enabled. Anyway this URI is as close as I've been able to get to any sort of explanation. I never see it except when this issue is occurring. Is there any way to block a user role from executing this 'touch' search? Is this a cause or just another symptom? There are 12 datamodels in my app and this is happening to all of them except the slimmest 1 or 2. It occurs most often when the system has a lot of incoming data to crunch so it does seem to be process- or resource-related. ... View more

I am trying to get both latest() and values() of a multivalue field. I am sending the field to Splunk as a comma-separated list of IDs. So, for a single event, I would get 4,5,24 . In props.conf , I create a multi-value field so I can use a CSV lookup from the field without having to split it in each search" EVAL-mv_id=split(id,",") . Then, at search time, I can do the lookup: lookup cat_id.csv mv_id output catname , which gives me a multi-value with 3 values for catname . However, when I do | stats latest(mv_id) AS mv_id latest(catname) AS catname BY group , only one of the values are returned, so I only get 4 and a single catname , although 4 , 5 , and 24 are all from the same event and were sent at the same time. This is a problem for me because I want both the multi-value latest(catname) and values(catname) . I realize I could do the following: | stats latest(id) AS latest_id values(id) AS values_id BY group | eval mv_id=split(latest_id,","), values_id=split(values_id,",") | lookup cat_id.csv mv_id OUTPUT catname | rename catname AS latest_catname, values_id AS mv_id | lookup cat_id.csv mv_id OUTPUT catname | rename catname as values_catname | table latest_catname values_catname group That just seems unnecessarily complicated to me, especially since the latest ID truly is a multi-value. Is there a better way to do this? Is there something I'm missing in the props.conf EVAL or elsewhere? ... View more

I am trying to create a "between now and now string" using the following: <input type="time" searchWhenChanged="true"> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> <change> <set token="earliestToken">$earliest$</set> <set token="latestToken">$latest$</set> <eval token="earliestEpoch">case(isnull($earliest$) OR $earliest$=0 OR $earliest$="", relative_time(now(), "-95d"), isnum($earliest$), $earliest$, $earliest$="now", now(), true(), relative_time(now(), $earliest$))</eval> <eval token="latestEpoch">case(isnull($latest$) OR $latest$=0 OR $latest$="", now(), isnum($latest$), $latest$, $latest$="now", now(), true(), relative_time(now(), $latest$))</eval> <eval token="earliestString">strftime($earliestEpoch$, "%T %x")</eval> <eval token="latestString">strftime($latestEpoch$, "%T %x")</eval> </change> </input> I have tested a couple of different things and it works if I use %c or "%a %b %e, %Y" and even for just %x or %T . Is there any good reason the combination of %T %x won't work? ... View more