I'm using fieldformat (Splunk 5.0.5, search head in a cluster, if that matters) in order to change how the time is displayed and to preserve proper sorting in tables, however it appears that it does not work correctly at all (sorting still fails). Here's what I'm doing: index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat Time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time Time host Account_Name This displays a table that uses both the original _time and Time. The Time variable is properly displayed but sorting by it fails. If I do this: index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat _time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time host Account_Name Then time is completely lost and all entries show as 1/1/01 12:00:00.000 AM. Any clues? ... View more

Hi, I'm writing a custom command that is supposed to do some actions on Splunk through its REST interface so I wanted to use the SDK. However, I'm having problems authenticating with the session token. Here's the setup: In commands.conf: [mycommand] filename = mycommand.py generating = true maxinputs = 1 stderr_dest = message passauth = true The code (auth part): import splunklib.client as client import splunk.Intersplunk as si settings = dict() records = si.readResults(settings = settings, has_header = True) sKey = settings['sessionKey'] service = client.connect(token=sKey) a = service.apps["search"] st = a.state() And I don't get anything back. If I change the client.connect call to use hardcoded credentials it works without any problems. In Splunk I'm logged in as admin. Any idea why I can't pass tokens like this to the Service class? ... View more

Hi, I have a couple of servers that were 4.x and I updated them to 5.0.2. I also installed the latest Deployment Monitor application. However, now accelerated searches are not working at all. In Manager -> Report Acceleration Summaries they are all listed like this: c61755ddd7cc1021 forwarders_summary_10m dm_license_summary_10m_by_forwarder 0.0000 0 Last Access: Never Summarization not started Updated: Never a7d992d7273cd430 dm_license_summary_10m_by_sourcetype 0.0000 0 Last Access: Never Summarization not started Updated: Never If I go to a search in Manager -> Searches and reports and select one (for example sourcetypes_summary_10m) I can see that the search is: `sourcetypes_summary_10m` And it's accelerated to 3 months summary range. However, when I click on Save I get the following error: Encountered the following error while trying to update: In handler 'savedsearch': This search cannot be accelerated Checking the macro it looks ok. Puzzled. 😕 ... View more

I setup around 15 reports to be accelerated. Everything worked fine till about couple of hours ago. Now all reports are showing as Pending (including the dm_ reports that came with the Deployment Monitor app) and they are not updating any more. This probably happened after I added some new inputs and restarted Splunk couple of times. Any idea what to check? There are no searches running at all on the server and, while it's indexing about 20 GB per day, CPU usage is like 7%. ... View more

Hi, I'm having some issues with the nullValueMode with FlashChart. It appears (at least with 4.3.3, have to test if this is something new) that the connect nullValueMode does not work with some data with FlashChart. I have data that is populated every 5 minutes and I want to connect it in stacked area mode. When looking at last 4 hours, for example, everything works ok. However, last 60 minutes or last 15 minutes simply do not have connected data. What's even more weird is that it works fine with JSChart (any time range), so FlashChart is only having problems. While I normally like JSChart more, I miss those "areas" you can click on when using FlashChart - with JSChart you have to click on the marker (or is there way to change that)? ... View more

I'm having a field that is being specifically indexed (and not extracted during search time). The following configuration is used: props.conf: [mysourcetype] TRANSFORMS-bla = indexex transforms.conf: [indexex] REGEX = ^(\d+) FORMAT = MYFIELD::$1 WRITE_META = true fields.conf: [MYFIELD] INDEXED = true This all works fine in normal indexes. However, I'm creating a summary index that contains the same field, like this: index=myindex *searchsomething* | table something MYFIELD This is also indexed fine, however I cannot search by MYFIELD directly: index=summaryindex MYFIELD=something yields 0 results. This works though: index=summaryindex | search MYFIELD I tried adding an indexed field for the stash sourcetype but it didn't help. Is this an issue due to the field being indexed (and fields.conf applied globally)? Do I have to change the field name (searching through summaryindex for other fields works, it doesn't work only for this field). Thanks. ... View more