Just seen this very old Answer concerning the XML view template: https://community.splunk.com/t5/Dashboards-Visualizations/Edit-the-default-dashboard-template/m-p/17091 This would seem to imply that onunloadCancelJobs is the default behaviour (generated into the XML preamble), but the docs indicate there is no default setting. I do not know enough about how splunk does all this to figure it out. I cannot find any other references except these two, apparently contradictory ones. Anybody on the inside care to clarify the actual situation? I'd like to know whether to add this rather useful property to all my views since I've only just found out about it. Also, if it's not the default behaviour....why not? Thank you, Charles ... View more

Hi there, I'm seeing a strange problem with version 8.0.8 I have a search to build a lookup table one time only, which has to look back 60 days in order to correctly populate. I'm also working on hourly updates for this, but that part is much less of a problem. I do not have access to summary indexing here, so don't bother mentioning it! It so happens that the admins of this site have enabled tsidx reduction so I'm seeing this warning:   Search on most recent data has completed. Expect slower search speeds as we search the reduced buckets.   Not in itself a huge problem as in the search box I eventually see all the available results. HOWEVER... When I run this search into outputlookup, it doesn't seem to wait for all the results to render and goes off and writes the lookup table without (very annoyingly) waiting for one particular column to appear. Is this a bug? Has anyone else seen this? Any way around it? It seems to be entirely consistent and I want to stop hammering the splunk instance with this very expensive search! Cheers, Charles ... View more

Hi there, I'm facing an interesting problem with fairly complex logs consisting of one or more xml namespaces, some of which have JSON objects embedded in them. I have this working fairly reliably using a transform-based field extraction and  SPL (the logs are all over the place, separate problem!) but I was wondering if anyone can suggest how to do this automatically using props and transforms without having to use spath in a base search to do all the finagling. transform extraction: REGEX=<([:\w+)>([^<]+) FORMAT=$1::$2 This gets out all the xml tags, which generally have the format tns:SomethingOrOther, and associated values. The json bit is usually in tns:Payload SPL: index=TheIndex sourcetype=theSourcetype | spath input=tns:Payload This is reliable enough but I'd like to recommend improvements to the site. The more general question here is, where you have complex logs of this type, how can you configure props/transforms to do the right operations and in the right sequence? i.e. xml first, then json extraction. If you try the other way round, it wouldn't work--would it? If you had the opposite problem, xml embedded in json, how would you do that? Is it even possible to control the order in which props attempts structured extractions? Certainly props supports extracting both types of values, but how do you know which one it tries first if you configure both? Props seems to assume you're only looking at one type of thing per sourcetype, not the case here--unless I've missed something. Of course if props simply executes them in order encountered in the file, there isn't much of an issue. However I have some constraints here which prevent me from just experimenting with it: --no access to sourcetype configuration, nor am I likely to get it --cannot download any of the data, which is commercial in confidence and the site take this very, very seriously --no dev or test environment (!) Strange but true for an enterprise of this size and prominence.     ... View more

I have been participating in Splunk Advanced Searching and Reporting course and there is one thing that is mentioned in the materials but not really explained anywhere that I've found so far. When creating lispy, splunk will use lookups and field extractions from search time, presumably because they are in the knowledge bundle. However it will not use field aliases, according to the course materials. So three questions arise from this: 1. Why not aliases? Especially since these underpin the CIM to a great extent. 2. What other search time KOs are/are not evaluated when it's time to create lispy expressions. 3. Where is this documented? ... View more