To increase the 10 MB limit, you'll need to change the MAXIMUM_EDITABLE_SIZE value in the settings.py file found in this directory:  /opt/splunk/etc/apps/lookup_editor/bin/lookup_editor   ... View more

any other suggestions?,any suggestions? ... View more

Hi uvmk61, this will work as a two step process, take a look at this answer here https://answers.splunk.com/answers/111602/trigger-a-pdf-via-the-command-line.html Or maybe check this app https://splunkbase.splunk.com/app/4030/#/details maybe this app can do such a thing (disclaimer: never tried this app, so I don't know). Hope this helps ... cheers, MuS ... View more

@uvmk61, Just a suggestion , if you just want to alert based on one field, you need not select "All Time" and do a timechart because it searches all your events and sends an alert if the condition matches - even for the past (5 years?) . If you are planning to schedule this alert for every let's say x minutes, then it's better to search for last x minutes and send an alert. For e.g. For last 10 minutes |node_details(SERVER NAME) | search Node_ID="Node3" (stats.key="node.cpu.sys.max" OR stats.key="node.cpu.user.max") | eval usage_by = case('stats.key'="node.cpu.user.max", "User", 'stats.key'="node.cpu.sys.max", "System") | eval stats.value = round(('stats.value'/10),1) | stats avg(stats.value) as stats.value by stats.key | where stats.value > 4 If you want to restrict it only for System, use where (stats.key="System" AND stats.value > 4) Lets know if you have other requirements to use the timechart ... View more

Thank you! Now the error still shows within the Chargeback App. The error has disappeared from Search and Reporting App though. ... View more

-Data Gov (is it usefull, what is the coast) -Writing to twiki SMEs, Owner, etc -Sending sample data -Chosing index, sourcetype, entitlements -Applying best practice to onboard -Pushing to prod -Monitoring File monitoring is the easiest and very good. HTTP collector is good but not as mature. If possible stay away from syslog unless you know what you are doing Feel free to ask details ... View more