I have a large set of data that comes in to splunk regularly but on couple days delay. It needs to be accelerated to be usable in our environment but I think If I wanted a 7 day datamodel I would need some way to tell the datamodel to start accelerating at -3d and go back 7 days from there to give the data some time to get in instead of starting now and going back 7 days as data will never be in "now". Any thoughts / suggestions other than just making a summary index manually? ... View more

Is there any internal logs on datamodels that could help me get better insight into their performance? Specifically I want to know their percent completion at any given time. ... View more

In the serverclass.conf docs it says that the "hostname of the client, as provided by the client" can be used in the white/black lists. What exactly does this mean? Does the uf grab the output of the hostname command as if it were run that on the host, or is it simply a value in a conf file like inputs.conf (host=) or server.conf (serverName=)? I know that clientName comes from deploymentclient.conf and the other options listed in the doc are self explanatory but Its unclear to me what the line "as provided by the client" really means ... View more

Hi, I want to be able to quickly create a HEC token through the UI and assign it to the proper output group. The problem is that none of my output groups show up in the UI despite the fact that they work. If I manually edit the inputs.conf to include "outputgroup=" the data will go to the right group but I don't want to have to do that every time I create a token. Where can I configure output groups such that they will appear in the UI? Currently they are defined in a random app's local/output.conf but I also tried placing them in /splunk_httpinput/local/outputs.conf (and restarting) to no effect. Thanks ... View more

Hi everyone, I have Splunk_TA_aws and Splunk_TA_aws_knowledgeonly deployed to a distributed splunk environment from a deployment server. On the heavy forwarders UI we have configured inputs which get placed locally on the heavy forwarders in Splunk_TA_aws/local/inputs.conf. Now I need to adjust some search time extractions so on the deployment server I have edited Splunk_TA_aws_knowledgeonly/local/props.conf with my changes. This is so when I deploy config the local inputs on the heavy forwarders are not overwritten. It is my understanding that Splunk_TA_aws_knowledgeonly/local/props.conf should be able to overwrite Splunk_TA_aws/default/props.conf given that they contain the same stanza name but my search time extractions don't seem to be working. If I however simply move the file from Splunk_TA_aws_knowledgeonly/local/props.conf to Splunk_TA_aws/local/props.conf manually on a test server the extractions begin working immediately. What am I doing wrong? ... View more

Hello, We just upgraded to 6.5.1 and it seems to have broken several key features of our dashboards. 1) In the Splunk 6.x Dashboard Examples app, the suggested method of assigning custom width to xml panels is with a custom javascript file. This worked great prior but after the upgrade all panels that use the <depends=”$token$”> feature to appear only when needed do not adhere to the javascript (js) width. They simply always split width evenly across the row ie 50/50, 33/33/33, etc. depending on the number of panels. Has anyone else seen these issues and/or come up with a reason or workaround? At this time I do not want to switch the dashboard to full html but would like to have custom width and the depends tag at the same time. I have included an example snippet that will show panels using depends ignoring js and panels that do not use depends adhering when in version 6.5.1. Thank you for your time. XML <form script="default.js"> <label>Testing</label> <fieldset submitButton="false" autoRun="true"> <input type="time" token="field1"> <label></label> <default> <earliest>-5m@m</earliest> <latest>now</latest> </default> </input> <input type="checkbox" token="show" searchWhenChaned="true"> <label>debug.show</label> <choice value="yes">yes</choice> </input> </fieldset> <row> <panel> <table> <search> <query>sourcetype=* | stats count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">2</option> </table> </panel> <panel> <table> <search> <query>sourcetype=* | stats count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">2</option> </table> </panel> </row> <row> <panel depends="$show$"> <table> <search> <query>sourcetype=* | stats count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">2</option> </table> </panel> <panel depends="$show$"> <table> <search> <query>sourcetype=* | stats count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">2</option> </table> </panel> </row> </form> And the JS require([ 'jquery', 'splunkjs/mvc/simplexml/ready!', 'splunkjs/mvc', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/postprocessmanager', 'splunkjs/mvc/eventsviewerview' ], function($) { var mvc = require('splunkjs/mvc'); var tokens = mvc.Components.get('default'); // token model var ensureFit = function() { var firstRow = $('.dashboard-row').first(); var panelCells = $(firstRow).children('.dashboard-cell'); $(panelCells[0]).css('width', '70%'); $(panelCells[1]).css('width', '30%'); var secondhRow = $('.dashboard-row')[1]; var panelCells2 = $(secondhRow).children('.dashboard-cell'); $(panelCells2[0]).css('width', '60%'); $(panelCells2[1]).css('width', '40%'); console.log("panels resized"); $(window).trigger('resize'); } ensureFit(); }); ... View more