This TechTalk, which I am very much interested in, has originally been scheduled for an earlier date and I signed up for that. Now that it has been moved to Aug-21 I have a scheduling conflict. Will there be a recording of the talk to which signed up people will have access later? ... View more

Found the same file mysteriously auto-created and after a bit of tinkering found what caused its creation, at least in my case: splunk backup kvstore -pointInTime true -archiveName my_archive The file vanishes again once the process finishes. But if for some reason it crashes/gets killed/whatever, the file is left in the filesystem. ... View more

Yep, foreach is the way to solve this. Thank you. ... View more

Bingo! A good way to achieve the result. It fits my need perfectly, I just could not think of it myself. Thank you. ... View more

@dimrirahul : Thanks, the -systemd-managed 0 flag works fine, saves me a lot of trouble. Too bad it is not documented in splunk help enable boot-start . ... View more

Depending on your environment and exact requirements, there might be another approach. If you have control over how all the systems sending data are willing to do a bit of additional manual or automated synchronization work of indexes.conf are happy with the backup having all the data, but not necessarily in the same buckets as your live data then you could setup a "backup" indexer: one dedicated single indexer (not part of your indexer cluster!) configure the "backup" indexer with the same indexes.conf files except the settings which determine how long the data remains in hot/warm/cold (time or size settings) configure all the indexes on the special "backup" indexer so the buckets are frozen after a relatively short time, for example one day make sure that your systems send the data to both, your regular indexer cluster and your special "backup" indexer The data on your regular indexer cluster remains available and is searchable. Your search head(s) only use this indexer cluster. The copy sent to the "backup" indexer is for backup purposes only; it is frozen after a short time due to the different settings and you can backup the frozen data and even remove it once it's backed up. The "backup" indexer does not need too much disk space as it only stores the data for a relatively short time. The disk requirements on your regular indexers could possibly be somewhat reduced too if you don't need to freeze buckets there any more and can just delete the data when it times out. Just an idea, but theoretically it should work. ... View more

Awesome! I had tried something similar before but couldn't figure out how to get the size of a whole row. Didn't think about going through each field separately. Quite resource intensive, though, as you mention in the code itself. Doesn't work well for me when using the REST endpoint |rest/services/data/lookup-table-files splunk_server=local This one works better for me: |rest /servicesNS/$env:user$/$env:app$/data/lookup-table-files splunk_server=local And all the $TOTAL_FIELD_VALUE$ cause problems in my dashboard as I use a form, replacing it with #TOTAL_FIELD_VALUE# works fine. Still, awesome! ... View more

Thanks for letting us know and the link to the detailed instructions! Appreciate it. ... View more

You have too many events in the time_window=30m timeframe for streamstats to handle (default=10'000). Considering your event count of close to 1 billion I would recommend to go for fixed instead of sliding 30 minute windows: index="XXX" sourcetype="XXX" NOT IP="xxx.xxx.xxx.xxx" NOT IP="xxx.xxx.xxx.xxx" | bin _time span=30m | stats dc(SESSIONID) as COUNT_SESSIONID by IP _time | search COUNT_SESSIONID > 50 | table _time IP COUNT_SESSIONID Not exactly what you are looking for, but an approximation, which hopefully is good enough. ... View more

The message is not caused by a lack of disk quota, but by the maximum window size used when using the time_window option to the streamstats command. Increasing srchDiskQuota won't help. ... View more

Works. Thanks for the info. (Not really happy, though, to give our normal users a capability which, by default, is admin-only...) ... View more

Thanks for finding this out. Ran into the same problem and probably would not have figured it out myself. Interesting variation I had on this: it worked fine when accessing splunk with a short hostname (eg: splunk:8000) and I only got the error when using a fully qualified domain name (eg: splunk.my.domain.org:8000). ... View more

As of 6.5.3 the partial fix works: first press CTRL , then without releasing CTRL press AltGR + \ Partial fix, because it adds a backslash at the end of the search, which it should not and which you need to remove manually. ... View more

Splunk support confirmed that v2 is slower and it's in the release notes too ( https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/ReleaseNotes -> TAG-9567 - but didn't expect it to be so much slower). According to Splunk Support, they have no intention to fix this :-[ But they continue to support v1 for those folks who can live with java. We are considering to go back to v1. ... View more

I don't think AD is slow. We experience very long reply times too, but only since we updated to SA-ldapsearch v2.4.1. On one test machine, we still have the old version (v1.1.10) running, and the same query to the same AD servers is constantly much faster, depending on the query 2-10 times faster. ... View more

A paging solution. Never thought about that but it sounds like some kind of alternate plan. For your section 1 and 3 I see how that works. For section 2 I'll have to do some digging and thinking how to achieve that. ... View more

Does not work in v6.5.0 at least for (Swiss)German keyboard layouts. According to splunk support, this should be partially fixed in v6.5.2 (SPL-130405) with a final fix in the upcoming 6.5.3 (SPL-135965). ... View more

If you're using an SH cluster, changing this manually in savedsearches.conf on the filesystem in one indexer, it may well be overwritten again when making a change in the GUI on another indexer. This is because manual changes are not replicated in the SH cluster. Instead make the change using the GUI: Settings -> make sure you have 'Show All Settings' turned on -> Searches, reports, and alerts -> find the line with your search -> Advanced edit. There you'll find display.visulaizations.show too and can change it. ... View more

Just a note if somebody runs into the same problem we did: ... -d value="groupA;groupB;groupC" everything after the first semicolon is cut and ignored, even though properly quoted in the command line. We could get around that by using the hex code representation for the semicolon: ... -d value="groupA%3bgroupB&3bgroupC" ... View more

I second that for splunk 6.3.3 with DB Connect 1.1.7. Disable the input; change the file; enable the input. Works fine. ... View more

That starts to make sense. It appears I was mixing the two approaches documented at http://docs.splunk.com/Documentation/Splunk/5.0.4/Viz/Exampleform#Use_the_same_search_in_multiple_panels in an incompatible way. With <searchTemplate> using $resolution$ multiple times seems to work, but not with <searchPostProcess> . Thanks for explaining. ... View more