I'm using fieldformat (Splunk 5.0.5, search head in a cluster, if that matters) in order to change how the time is displayed and to preserve proper sorting in tables, however it appears that it does not work correctly at all (sorting still fails). Here's what I'm doing: index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat Time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time Time host Account_Name This displays a table that uses both the original _time and Time. The Time variable is properly displayed but sorting by it fails. If I do this: index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat _time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time host Account_Name Then time is completely lost and all entries show as 1/1/01 12:00:00.000 AM. Any clues? ... View more

Hi, I'm writing a custom command that is supposed to do some actions on Splunk through its REST interface so I wanted to use the SDK. However, I'm having problems authenticating with the session token. Here's the setup: In commands.conf: [mycommand] filename = mycommand.py generating = true maxinputs = 1 stderr_dest = message passauth = true The code (auth part): import splunklib.client as client import splunk.Intersplunk as si settings = dict() records = si.readResults(settings = settings, has_header = True) sKey = settings['sessionKey'] service = client.connect(token=sKey) a = service.apps["search"] st = a.state() And I don't get anything back. If I change the client.connect call to use hardcoded credentials it works without any problems. In Splunk I'm logged in as admin. Any idea why I can't pass tokens like this to the Service class? ... View more

Hi, I have a couple of servers that were 4.x and I updated them to 5.0.2. I also installed the latest Deployment Monitor application. However, now accelerated searches are not working at all. In Manager -> Report Acceleration Summaries they are all listed like this: c61755ddd7cc1021 forwarders_summary_10m dm_license_summary_10m_by_forwarder 0.0000 0 Last Access: Never Summarization not started Updated: Never a7d992d7273cd430 dm_license_summary_10m_by_sourcetype 0.0000 0 Last Access: Never Summarization not started Updated: Never If I go to a search in Manager -> Searches and reports and select one (for example sourcetypes_summary_10m) I can see that the search is: `sourcetypes_summary_10m` And it's accelerated to 3 months summary range. However, when I click on Save I get the following error: Encountered the following error while trying to update: In handler 'savedsearch': This search cannot be accelerated Checking the macro it looks ok. Puzzled. 😕 ... View more

I setup around 15 reports to be accelerated. Everything worked fine till about couple of hours ago. Now all reports are showing as Pending (including the dm_ reports that came with the Deployment Monitor app) and they are not updating any more. This probably happened after I added some new inputs and restarted Splunk couple of times. Any idea what to check? There are no searches running at all on the server and, while it's indexing about 20 GB per day, CPU usage is like 7%. ... View more