Check the memory usage - the smallest micro AMI that Amazon provides doesn't have enough RAM to allow the Pivot interface to function correctly. ... View more

On Splunk 6.4, _cd doesn't seem to be a field... Does anyone know how to identify which bucket an even is in on the newer versions? ... View more

Marklar, you are correct. The ltrim approach would be preferable, except in the case when you need to keep one zero, which is what we need to do in this case, and therefore that option will not work for us. (Instead of ending up with date_hour::0 , we would end up with date_hour:: , which doesn't work.) ... View more

Ah fair enough. So the problem no longer is searching for the empty string, but rather how to extract it so that I can later search for it. Still seems like I can't get it done properly. I either end up with '' as a value with AUTO_KV set to auto and with AUTO_KV set to "none" it will simply not recognize that the event with the empty field have a field-value pair at all. ... View more

Whoa, I like the new ScriptedAuth doc. Thanks Marklar and Josh. ... View more

It is very sweet. Thank you, Marklar! So my IP range searches now are even shorter. I've even defined macros so my searches are super short, too: For outbound traffic: ( Src_Addr=10.0.0.0/8 OR Src_Addr=172.16.0.0/12 OR Src_Addr=192.168.0.0/16 OR Src_Addr=169.254.0.0/16 ) AND ( Dst_Addr!=10.0.0.0/8 AND Dst_Addr!=172.16.0.0/12 AND Dst_Addr!=192.168.0.0/16 AND Dst_Addr!=169.254.0.0/16 AND Dst_Addr!=65.194.243.* AND Dst_Addr!=216.52.215.* ) ... View more