I set maxHotSpanSecs=7200 and tried indexing a old log file containing a days worth of logs(~250mb 1 million events). As per my understanding, it should create a bucket for every 2 hours worth of logs it indexes. But for some reason, it indexed all of it in a single bucket. Am i missing something here ? Or have i misunderstood the definition ? ... View more

Here is my usecase(translated): eg:- I have the list of countries in a file countries.txt It has the following content USA Mexico Canada and i have a generic search like this index=$country sourcetype=tweets earliest=-7d@d | timechart span=1d count I need to lookup this file and since it has 3 entries my dashboard should have three panels(chart or table or single) with corresponding searches index=USA sourcetype=tweets earliest=-7d@d | timechart span=1d count index=Mexico sourcetype=tweets earliest=-7d@d | timechart span=1d count index=Canada sourcetype=tweets earliest=-7d@d | timechart span=1d count Is this possible ? Please let me know if I am not clear enough. ... View more

We are trying to enable https(SSL) for splunk web. While trying the settings I found that the old page or link (with http prefix) doesn't get redirected to the new page(with https prefix). The old link just goes to a blank page. How can this be achieved ? ... View more

I wantto create a multivalued field bar based on the value of an existing field foo in each event. For example: if we have these two events: event1 foo=3 event2 foo=5 then i should create something like this event1 foo=3 bar=1,2,3 event2 foo=5 bar=1,2,3,4,5 ... View more

We have seen the following splunkd daemon messages not responding in the ui.What does it mean? 2011-02-05 01:33:06,793 ERROR [4d4ca8a1dbc36cce90] decorators:347 - Splunkd daemon is not responding: ('timed out',) Traceback (most recent call last): File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 333, in handle_exceptions return fn(self, *a, **kw) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 1219, in render templateArgs = self.buildViewTemplate(app, view_id, action, q, sid, s, earliest, latest, remote_server_list, now=now) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 911, in buildViewTemplate appConfig = self.getAppConfig(app, view_id, build_nav) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 482, in getAppConfig output['nav'], tmp_dv = self.getAppNav(appName, output['available_views']) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 195, in getAppNav self._replaceNavTokens(navDefinition, viewManifest, app) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 248, in _replaceNavTokens searches = en.getEntities('saved/searches', namespace=app, search='is_visible=1 AND disabled=0', count=500) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/entity.py", line 152, in getEntities serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/rest/init.py", line 373, in simpleRequest raise splunk.SplunkdConnectionException, str(e) SplunkdConnectionException: Splunkd daemon is not responding: ('timed out',) 2011-02-04 07:32:20,499 ERROR [4d4bab6628ac84d4d0] decorators:347 - Splunkd daemon is not responding: ('timed out',) Traceback (most recent call last): File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 333, in handle_exceptions return fn(self, *a, **kw) File "", line 1, in File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 388, in apply_cache_headers response = fn(self, *a, **kw) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/account.py", line 111, in login sessionKey = splunk.auth.getSessionKey(username, password, hostPath=self.splunkd_urlhost) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/auth.py", line 21, in getSessionKey serverResponse, serverContent = rest.simpleRequest(uri, postargs=args) File "/home/splunkuser/splunk/search-head-ui/lib/python2.6/site-packages/splunk/rest/init.py", line 373, in simpleRequest raise splunk.SplunkdConnectionException, str(e) SplunkdConnectionException: Splunkd daemon is not responding: ('timed out',) ... View more

Is there a way to get the metrics for dashboard usage ? ... View more