For the manual localize endpoint mentioned: curl -ku admin:changeme "https://localhost:8089/services/admin/cacheman/_localize" -X POST  Will it be localizing of all the buckets, of all the smartstore enabled indexes?  What are the specific endpoints for localizing an individual bucket or index? ... View more

Hist to add some more information on bootstrap. For large deployments, customer get concerned while running bootstrap when env have millions of buckets. As you know, bootstrapping would ensure that buckets which are already present on cluster would not be created again on the cluster. bootstrapping would just list all the buckets on S3 and would then create the buckets which are not present on the cluster. It is usually quick as well. Hence if the customer is only missing few buckets on the cluster, we can initiate bootstrapping and it would create these buckets. Noe for the Question : List all buckets on s3 for 7 million buckets -> is that still ok / fairly safe / quick? if we do want to discover these buckets, bootstrapping is the only option currently. it is not supported per index. the entire operation is detached from the usual operations of CM - it is safe and quick as well. ... View more

Vincent, I am trying to replicate the Gantt Visualization for monioring batch jobs. Can you please give me a rough idea in brief. Thanks in advance ... View more

Sorted - I missed the bit documented here: http://wiki.splunk.com/Deploy:DeploymentServer the "phoning" has to be enabled on the "other" forwarders. ... View more

You can do that once you have a PID field in sourcetype B extracted like shown above. sourcetype=B [search sourcetype=A some magic filter | dedup PID | fields PID] The subsearch evaluates to an OR'd list of PID=1234 filters, which are applied against your configured EXTRACT-PIDinsource . ... View more

Thanks Yank, I actually started on a Universal forwarder but can't get it to work on my local full install neither. Assuming all the log levels were set to DEBUG, where could I expect to see the regex being applied? thanks again ... View more

Here is something simple and similar to the above answer, but is all cli. Replace localhost with your host ip/hostname Replace testdude with your username which you must know the password for. Then run it. read -s -p "Enter Password: " mypassword;t= curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword ;mytoken= echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d' ;curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10";mypassword="";mytoken="";t="" Here it is broken down. read -s -p "Enter Password: " mypassword; allows you to enter password with entering it on command line and stores it in a variable, which is cleaned up at end. t= curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword ; stores tokenized output in variable, which is cleaned up at end. mytoken= echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d' ; uses above variable/output and strips it down to just token and stores it in variable curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10"; uses token to run search mypassword="";mytoken="";t="" cleaned up of variables used. P.S. Please shoot holes/refine it. I think it will make it more useful for everyone. ... View more