I am using a powershell script to deploy Splunk to many servers (circa 150). Works a treat UNTIL I try to do an upgrade to a new version at which point my install command fails. Splunk is basically detecting the upgrade and prompting me for a y/n. Can I suppress this prompt and force the upgrade through? The output I get is as follows: Splunk has detected an older version of Splunk installed on this machine. To finish upgrading to the new version, Splunk's installer will automatically update and alter your current configuration files. Deprecated configuration files will be renamed with a .deprecated extension. You can choose to preview the changes that will be made to your configuration files before proceeding with the migration and upgrade: If you want to migrate and upgrade without previewing the changes that will be made to your existing configuration files, choose 'y'. If you want to see what changes will be made before you proceed with the upgrade, choose 'n'. Perform migration and upgrade without previewing configuration changes? [y/n] ... View more

Is it just me or is 'Reporting' not actually a report package at all? See a mail exchange I have had with support below. Has anybody used a third party package with Splunk to generate management reports? Email extract below: .............. Hi Octavio, Please see attached file here. I suspect we will use an external reporting package in the short term but I view this as serious deficiency in Splunk. I am not expecting a 'solution' to this but it would be good to know that the features I am requesting are being put into Splunk at some point. Having just paid over 100k for this package I am very disappointed that I am having to export as a .csv in order to use a third party reporting package!! I fully expect to be asked some searching questions about this by management, having recommended the product! General Comments: 1) I want to be able to format a business oriented report based on results from the datasets we have collected. The current 'report' module is actually just a way to put together charts and tables, which we can do programatically in anycase. 2) Please see any reports package for the basic features we would want to see. As a minimum the following features would be required: A) Titling. I need to be able to add a title to a report. I need to be able to title individual elements, e.g. Chart A showing Trade Volumes foloowed by a chart. B) Control over pagination and layout. If I print a standard view or a report view I have no control over pagination and layout. The results can look very poor indeed. C) Header and footer information. For multi page reports I need header and footer detail which would include text, page numbering etc. Again, see any reports package for an exhaustive list. D) Support for general metadata such as Date, Time etc. If I issue a report, its likely to relate to a particular day and would potentially be used for regulatory purposes. If its not dated its useless!! E) Support for multi page printouts of tabular information. If I have a table with 300 pages I currently have no way to print it!! My only option is to build yet another screen and output to CSV then use a third party package to format. This is very poor indeed!! F) Support for formatting of columns of tabular information. Specific Comments on Current Implementation: 1) See the attached file. You will see that what I am getting is a screen dump NOT a report based on the data retrieved. Basically when you use report and hit print, it simply rescales to the current default print page size (no opportunity to resize or rescale) and it blindly prints the redered page. I get all the application menus and the big report buttons!! Currently I will be forced to use a third party tool to cut and past results into a hand written report!! This is not great at all. 2)Once the print completes, the page resizes again but the chart doesn't re-render. This is a general problem with charts which don't re-display after a render change. 3) The 'report' function actually gives much less than the simple xml approach (our summary reports are now being built in this way). So, in summary I don't actually think your 'report' tool is a report tool at all. Its just another way to build screens without coding. As such it doesn't fulfill any of my reporting requirements (and I suspect I am not alone in this). As a reponse I need to know if Splunk accepts this as a deficiency and if a solution will be added to the roadmap and what the initial timeframe will be. This is a serious issue for us and spoils an otherwise excellent product. Many thanks ... View more