We have an internal built application management tool to start Splunk and monitor it's process status. Search Head Clustering rolling restarting would basically break that. Provided that we'd like to manage the restart ourselves, can we turn this feature off? I saw an attribute called "percent_peers_to_restart" in server.conf. Can we achieve that by setting it to 0? ... View more

Anyone can tell where is the template of footer in Splunk? The default one contains these links. About Support File a Bug Documentation Privacy Policy ... View more

We're not ready to apply Search Head Clustering yet, but we're on Search Head Pooling now. Can we apply KV store quickly without waiting for SHC? ... View more

I'm creating an alert to notify me when license pool usage is over 90% of defined pool size. Firstly, I wrote the alert search and condition like this. But I couldn't get anything when it's over 90%. Search: index=_internal source=*license_usage.log type=Usage | eval used_gb=round(b/1024/1024/1024,2) | eval total_gb=poolsz/1024/1024/1024 | stats sum(used_gb) as used_gb first(total_gb) as total_gb by pool | eval percentage=round(used_gb/total_gb*100,2) Condition: if custom condition is met "search percentage>=90" After that, I change to this and it works! Search: index=_internal source=*license_usage.log type=Usage | eval used_gb=round(b/1024/1024/1024,2) | eval total_gb=poolsz/1024/1024/1024 | stats sum(used_gb) as used_gb first(total_gb) as total_gb by pool | eval percentage=round(used_gb/total_gb*100,2) | where percentage>=90 Condition: if number of events larger than 0 Anyone can tell what's the difference? Thanks! ... View more

Basically I want to make my own internal licensing model. Is there any attribute I can set on a license subscription? For example, I just want to let development instances take 10GB of index volume, after 3 months it will expire? Can I achieve that? ... View more

I saw someone mentioned this is possible from 6.2.2. I want to verify if it's true and if there's any document mentioned this. http://answers.splunk.com/answers/7960/red-error-warning-bar-in-splunk.html Furthermore, I hope it can be done per role. For example, admin can see system messages, but general users can only see their own errors. Is it possible? ... View more

I have few questions regarding to user-seed.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/User-seedconf Is it only applied in first run? Or it will be taken after restart everytime? Only applied to "admin" The spec mentioned "Currently, only one user can be configured with user-seed.conf." Related to both 1 & 2, can I use it to create/change password for another user after restart? ... View more