Hello Giuseppe, Tried opening a non-technical case via the Support Portal, but was directed to where I needed to enter a support entitlement number to open any case. Then called the support number directly, but the automated menu system put me a loop over and over so that I never reached a support person to talk with. Couldn't figure out how to open a non-technical ticket with Splunk Support. Any specifics on how to do that ? Best regards, Dennis ... View more

Hello Giuseppe, Thanks, and will do this Monday.  🙂 Best regards, Dennis ... View more

Hello tshah-splunk, Increasing the max_upload_size in web.conf worked in my case. Gave you a Karma point. Thanks  😎 ... View more

Hello Giuseppe, Noticed it's been over 8 years since you posted your question, but came across this post will searching on how to make a text box empty by default.,,,,same as you were looking to do. Was working on a dashboard today, and thought what character is not ever in event data, and is not a character used by SPL for any reason.  The answer was the:  ~ This worked for me, like a charm, in a dashboard text box:    <initialValue>~</initialValue> <default>~</default> Best regards,   😎 Dennis ... View more

Hello, This is definitely an old post, but can anyone share how they have created a search to accurately list whether a saved search is either a report or an alert. This list exists under the menu item Searches, Reports & Alerts as the column Type lists whether it's a report or an alert, but the code underneath doesn't seem to be viewable like selecting a panel in a dashboard will show the underlying SPL. Also that report from Searches, Reports & Alerts which shows the Type doesn't seem to be exportable. ... View more

Hello, Just a heads up that the same app, Lookup Editor 3.3.3, also caused SplunkWeb to not start for Splunk Enterprise 7.2.6 even though the Compatibility section shows SE 7.2 included as of 3-12-20. For the Splunk folks, this caused many headaches as there was nothing in either the splunkd.log or the web_services.log indicating this was the issue. After adding, state=disabled, in the local app.conf file for the Lookup Editor app, and restarting then SplunkWeb started with no issue. Compatibility Products: Splunk Cloud, Splunk Enterprise Splunk Versions: 8.0, 7.3, 7.2, 7.1, 7.0, 6.6 Platform: Platform Independent https://splunkbase.splunk.com/app/1724/ ... View more

Thanks, downloaded six, and below in quotes is the related documentation I found. Do you simply copy the six.py file as suggested into the bin directory of the app where the non-compatible .py scripts are located? I did that, and ran the Upgrade Readiness App on that app again, but the python scripts still do not pass as Python 3 compatible. "Six provides simple utilities for wrapping over differences between Python 2 and Python 3. It is intended to support codebases that work on both Python 2 and 3 without modification. six consists of only one Python file, so it is painless to copy into a project." ... View more

Thanks, currently we're running Splunk Enterprise 7.2.7 which has the $SPLUNK_HOME/Splunk/Python-2.7/Lib folder. What is the detailed procedure for making these 2.7 lib's also dual compatible with Python 3.x version. ... View more

Hi Ansif, Your question was under "Questions related to License Usage Dashboard" so I assumed you were using the app "License Usage Dashboard". It provides more additional license usage data than the built in tool. License master _internal logs are sent to Indexer cluster. This is Splunk best practice. Do I need to install additional app in search head to view license usage for past 30 days? Don't need too, but try the License Usage Dashboard for additional license usage data reporting. Cant I make License master as Search head for this purpose? You can for test purposes, but its not Splunk best practice to dual-purpose the license master also as a search head, and as mentioned above the _internal logs from the license master are now being sent to the indexers. "The license master is configured to forward its events to the indexers (read more about this best practice in the Distributed Search Manual) but it has not been configured to be a search head. This is easily remedied by adding all indexers to whom the license master is forwarding events as search peers." Yes, all the indexers should be added and enabled as search peers. ... View more

Lycollicott and LeeSart are both on the right track. Just updated the app to 3.4, and added more detailed instructions about where to install the app which is listed below. Within the License Usage Dashboard app click the menu item Setup in the upper left corner, and you'll see the following setup instructions. Must Be Installed On The License Master Server, or Search Head depending on where the _internal logs are sent, and specifically the license_usage.log file. Best practice is to send the _internal logs to the indexer/s so in this case the app would be installed on the search head/s. To Include The "_internal" Index In The User's Role To View The License Data Select: Settings -> Access Controls -> Roles -> the specific user role under Role Name Add the _internal index to the Selected Search Indexes column under Indexes Save Here are a couple of additional troubleshooting tips: http://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/LicenseUsageReportViewexamples Troubleshoot LURV: no results in 30 days tab A lack of results in the panels of the Last 30 days view of the License Usage Report View indicates that the license master on which this page is viewed is unable to find events from its own $SPLUNK_HOME/var/log/splunk/license_usage.log file when searching. This typically has one of two causes: The license master is configured to forward its events to the indexers (read more about this best practice in the Distributed Search Manual) but it has not been configured to be a search head. This is easily remedied by adding all indexers to whom the license master is forwarding events as search peers. The license master is not reading (and therefore, indexing) events from its own $SPLUNK_HOME/var/log/splunk directory. This can happen if the [monitor://$SPLUNK_HOME/var/log/splunk] default data input is disabled for some reason. You might also have a gap in your data if your license master is down at midnight. In addition, make sure the number of days of _internal data being saved via frozenTimePeriodInSecs is more than 30, and that enough storage is allocated for that number of days. https://answers.splunk.com/answers/392100/how-to-get-the-the-splunk-license-usage-dashboard.html Here's the solution, folks! Increase the size of the internal index on the license server (change the full domain below): - Increase to ~ 30GB (if you can) Make a dashboard with this query (change the license amount to anything you want, then set it to overlay): index=_internal source=*license_usage.log type="RolloverSummary" | timechart sum(eval(round(b/1024/1024/1024))) AS GB | eval license = 100 Answer by andrewjhill Oct 25 at 11:45 AM andrewjhill · Oct 25 at 11:47 AM Update the local indexes.conf file as well -- example: /opt/splunk/etc/system/local/indexes.conf [_internal] maxTotalDataSizeMB = 30720 maxDataSize = 1000 tstatsHomePath = volume:_splunk_summaries/_internaldb/datamodel_summary coldPath = $SPLUNK_DB/_internaldb/colddb homePath = $SPLUNK_DB/_internaldb/db frozenTimePeriodInSecs = 31104000 thawedPath = $SPLUNK_DB/_internaldb/thaweddb maxHotSpanSecs = 432000 ... View more

Hello Ray, Thanks for the thumbs up, and the comment. I have changed the panel "Host Usage - Current Day - Top 20" so that the field "h", instead of the field "host", now shows results in the "Host" column. Also, added the field "host" to show results in the "Indexer" column, and the field "splunk_server" to show results in the "Splunk Server" column. From your results is the splunk_server always the Search Head? Sorry it took so long as this was the first time I've opened the "Questions on SplunkAnswers" link. Since your post in July have made many other changes to the License Usage Dashboard. Best Regards, Dennis Raesner ... View more

We're not running any search jobs. That high CPU usage is just from Splunk executing. You gave me an idea, will remove all the apps except 1 since this is a new installation, and see if the performance improves. ... View more

That appears to be the case that Splunk is occupying the cores. Nmon shows the 2 CPU's as 4 cores, and splunkd and python are using the majority of all 4 cores. ... View more

It's a dedicated JS12 blade in an IBM 7998-60X Blade Center H running AIX 6.1. 2 PowerPC_Power6 CPU's running at 3.826 GHz. 10 GB's of the 20 GB's of memory is available. Using nmon splunkd processes are the heaviest CPU users at over 100% all the time, and I'm not doing anything with SPLUNK. That high CPU usage is just from the SPLUNK executing. ... View more