in the vmware addon you have a scheduler, which you hook up to vmware (which you did), then DCNs, or data collection nodes, which do the actual pulling of data. this can be the same box that's a scheduler (just point to localhost) or another splunk HF. have you assigned any boxes to be a DCN, yet? ... View more

You're hitting the default of 2000 days, for "MAX_DAYS_AGO" in props.conf MAX_DAYS_AGO = <integer> * Specifies the maximum number of days in the past, from the current date as provided by input layer(For e.g. forwarder current time, or modtime for files), that an extracted date can be valid. Splunk software still indexes events with dates older than MAX_DAYS_AGO with the timestamp of the last acceptable event. If no such acceptable event exists, new events with timestamps older than MAX_DAYS_AGO will use the current timestamp. * For example, if MAX_DAYS_AGO = 10, Splunk software applies the timestamp of the last acceptable event to events with extracted timestamps older than 10 days in the past. If no acceptable event exists, Splunk software applies the current timestamp. * Defaults to 2000 (days), maximum 10951. * IMPORTANT: If your data is older than 2000 days, increase this setting. ... View more

As long as you have the "admin" role, you can do everything the admin user can. Also, you can still log in with local accounts, such as admin, using the URL: https://HOSTNAME/account/login?loginType=splunk ... View more

Is it a search head cluster? Also, how far apart are the numbers and can you share the search? ... View more

The most foolproof way to accomplish this would be to create a role that has no search permissions. Then, create the dashboards from reports that are ran/updated every 5 mins, or so. ... View more

Just run the command. Maintenance mode is not required. ... View more

When you first install splunk, everything in /opt/splunk/ is owned by "splunk". However, if you're running splunk as root, everything created, from there on out, will be owned by "root". To change this, stop splunk, run "/opt/splunk/bin/splunk enable boot-start -user splunk", then "chown -R splunk:splunk /opt/splunk" and start splunk back up. (keep in mind that "splunk" probably won't be able to run on port 80/443 without changing OS permissions) ... View more

when you set "action.email.maxresults", in the conf file, did you restart splunk after doing so? also, that parameter is available, in the GUI, under "advanced settings/edit" for that search ... View more

There's no way to answer this question as: we don't know what your storage and use policy is we don't know what your IT team set up splunk to monitor on your laptop (or where they're sending it) If i had to guess, i'd say they're just ingesting OS logs and sending it to their splunk server. However, there's not enough information to say. ... View more

is there a little paintbrush to the top right of your column? if so, click that and select color/range ... View more

I found the problem(s): "Year" has to be a capital "Y", instead of lowercase. Before "%N", you have a colon, instead of a period. Here's my working search: | makeresults | eval START_TS="2017-08-16 04:07:00.0" | eval END_TS="2017-08-16 04:12:00.0" | eval st = strptime(START_TS, "%Y-%m-%d %H:%M:%S.%N") | eval et = strptime(END_TS, "%Y-%m-%d %H:%M:%S.%N") | eval diff = et - st | eval dur = tostring(diff, "duration") More info on the date variables can be found here: https://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Commontimeformatvariables ... View more

If the logs are on the ftp server, can you just install the universal forwarder to send them to splunk? ... View more