Greeting Splunkers,  I'm researching an issue with Splunk scheduled reports and I came across the .conf2017 material "Making the Most of the Splunk Scheduler" (see attached snippet of page 10 of the material).    The issue we're seeing is some scheduled jobs are not returning results but when the same SPL that's in the job is run real-time there are results.    The jobs are scheduled as a cron within the Splunk UI Schedule "Run on Cron Schedule".    I came cross the .conf2017 material and maybe found an issue or concern related to the issue.   Can anyone please clarify a couple things:  - the material mentions that Cron is "Limited to a single machine".   What does this mean and how does Splunk determine which machine/server to utilize?    - we schedule most of jobs as Cron because it has a little more flexibility with the time to set the start time.  I also came across the limits.conf and authorized.conf documentation and found that all of the Splunk settings are still set to the default.   In further researching the issue, it seems there are approximately 30 jobs starting or running at 0400 when the job in question is not returning results.    So the other question is, are we hitting a system limit and can Splunk be optimized or tweaked to support more jobs and/or is the system limit causing the report to return no results?   If Splunk can be optimized/tweaked which parameters or settings needs to be changed?    Any thoughts?   Thanks in advance for any help and insight.    Cheers! ... View more

Greetings, I've 2 Lookup (csv) files, one generated from index _internal (approx 15k events) and another generated from ldap (approx 20k events) and both files have only the host name field.    When running the following SPL the "search NOT" is returning results that should not be included.    At first we thought it was a problem with case-sensitivity but we ruled this out by changing all the host names to upper-case but still the "search NOT" was returning wrong results.    "| inputlookup LDAP_source.csv | search NOT [ | inputlookup INTERNAL_source.csv ]" We've tested using 1k Lookup files without any problems.  Is there perhaps a limit being reached or a known issue with comparing 2 Lookup files using "search NOT"? Thanks in advance for any assistance or insight.   ... View more

Greetings Splunkers, I recently attended Splunk Fundamentals 3 and the instructor mentioned about a Splunk feature that automatically converts stats commands to tstats in order to try to improve performance.  The instructor did not go into details but recommended I post the question to the Splunk Community. Is there more information about this, i.e. the version this is or will be available in, etc?  Will/can we see the conversion happen in the Job Inspector or noop?   How does/will Splunk select which stats command to convert?   Is it only converting based on the metadata and indexed fields in the tsidx file OR will there be other criteria that tstats will convert? Thanks in advance for any insight or help with this. ... View more