Hi, If anyone come across this thread, could refer to Option 2 in this thread  "How to store results of searches in Dashboard?"  in order to achieve something similar. Build Report with loadjob  from "Saved Scheduled Search(es)". loadjob "Loads events or results of a previously completed search job. The artifacts to load are identified either by the search job id <sid> or a scheduled search name and the time range of the current search. If a saved search name is provided and multiple artifacts are found within that range, the latest artifacts are loaded." Happy Splunking! ... View more

In my case it was manually deployed to the HF and I couldn't see any windows carriage returns or line feeds but I still ran dos2unix on my local.meta anyways and restarted the HF and the log entries disappeared. I had to install it first.  >yum install dos2unix >dos2unix local.meta   ... View more

Thanks for your response.As you said,put LDAP related logging in debug mode and checked logs,no where found Maximum sizelimit but I have seen below error message in splunkd.log... 8-19-2015 11:30:19.683 -0400 WARN ScopedLDAPConnection - strategy="LDAP_End_User" LDAP Server returned warning in search for DN="OU=Groups,DC=yyy,DC=ds,DC=xxxxx,DC=com". reason="Size limit exceeded" As per document it defaults to 1000 even it increased it is not accepting,is there any other way? ... View more

In your case...even DataCollections Nodes are supposed to be in a time sync with rest of the Splunk Instances...?? ... View more

Thanks Ayn, you guys were right, it was an oversight on my part. My indexes.conf file was missing this particular index. I added it , now my indexer has the index definition and can catalogue the bit9 log data. thanks again for everyone's input. ... View more

Hi, we switched to Splunk's internal password storage mechanism in 2014 (version 2.0). ... View more

From Damien: A single backslash should work : Make sure that the command name and command arguments are in separate fields. Command name : c:\tools\mycommand.exe Command arguments : c:\logs\stuff\ -d 3 -n 11 -o c:\output\output.txt Also look in splunkd.log for any errors. ... View more

If you are running this via the Splunk GUI (eg, not a scheduled search) then make sure that you have set the Mode in the upper right corner to "Fast." This will help, but maybe not much. Second, when one of these searches completes, check out the Search Job Inspector - it is represented by a blue box containing an "i". The inspector contains a lot of information about how your search ran. This will tell you where most of the time was spent. Of course, you may want to ask follow-up questions about what some of those statistics mean! In fast mode, you can eliminate the | fields _raw portion of the command. To make better suggestions, we really need more information: How many events is Splunk searching? You said the search returns 97 million, but how many events did Splunk search to find that? Why are you writing 97 million events to disk as a csv file? There may be better ways to do this. ... View more

Hello, any solution without using a macro? Why does it filter with | search or | where filters? I want to filter sources having yesterday date in their filenames. Thanks. ... View more

bump. We applied this fix ages ago but still seems to be an issue today. ... View more

@Ayn: Thanks, that looks much better. It hadn't occurred to me that just the preview was broken. ... View more

Hi raziasaduddin there used to be a bug in 4.1.x which matches your description, see this answer. Contact Support if not yet done, don't forget to prepare a diag file before you file a support case 😉 cheers, MuS ... View more

Hello raziasaduddin - Can you open a request here at: https://netflowlogic.zendesk.com/home or contact us at: support@netflowlogic.com - I would like to see if we can setup a secure remote webex with you so we can take a look. Thanks! ... View more

Check out this pdf from FE. Describes non-admin user and using https to push data in. https://www.fireeye.com/content/dam/fireeye-www/global/en/partners/pdfs/fireeye-splunk-intermediate-guide.pdf ... View more

The reason that is not working is because EXTRACT is evaluated before a REPORT , i.e the field generated by the latter is not available when the former is called. Two REPORTS called in the proper order is the correct course of action here. ... View more

If you install the latest version of the FireEye app and change your notification configuration from rsyslog to HTTP POST w/XML it should resolve your issue (and get you loads more data into Splunk as a side benefit): http://splunk-base.splunk.com/apps/22354/fireeye The notification URL you need to use is listed on the splunkbase page as well. If you follow the configuration there you should be g2g. You don't even need to use the app if you don't want to, you really just need the props.conf stuff for the field extractions/transforms. -- Josh ... View more

Did you ever get any of these questions resolved? I'm hitting the very same problems. ... View more

Hi, Im not sure if it still relevant but I found to change the "tcpin" queue size you need to add queueSize in the inputs.conf under the tcp, so its probably the same deal for "udpin". Zur ... View more

This has finally been fixed in the new version of the app. No more cleartext Usernames and Passwords. We requested this, worked with an engineer, and it was fixed. ... View more