Hi @mattness assigned a savedsearch which admin created to a non-power userid which has a role to write to the savedsearch and to the app in which the savedsearch is in. But userid still cannot see the Edit button. What is missing? ... View more

I've written a python script dependency tracker (below) which is really just a fancy search tool. It's designed to run on the Splunk server and run from the directory from where you want to track. It recurses from the current folder looking for a search term in a .conf file. If it finds it it will return the filename and the KO name in which the search term occurs. """ Script which searches from local directory and finds KOs which include a search term Filters searches files by .conf extension. Starts searching from present working directory Can be run from any linux host with Splunk config files. It works by scanning .conf files from pwd. For each file it gets a list of all line numbers with a match. It then gets a list of all KOs (using pattern match: [some ko]). For each search match it will get the KO match at or above (i.e. lower than) the search match line number. It will then return a list of files and KOs. Was designed to be used by python 3.7.1-1 usage: #ssh to Splunk host cd $SPLUNK_HOME/etc/apps #apps only cd $SPLUNK_HOME/etc/ #apps and user config /path/to/python3.7.x /path/to/dependency_tracker.py --search_term whatever """ import argparse import sys import os import glob import re def get_parser(): """ Build an Argument Parser. Returns: parser: An argument parser """ parser = argparse.ArgumentParser() parser.add_argument("--search_term", help="The name of the KO which is the dependecny", required=True) return parser def get_matching_files(search_term): #Use glob to recursively search for .conf files from pwd pwd = os.getcwd() search_path = '{}/**/*.conf'.format(pwd) regex_searchterm = re.compile(search_term) regex_ko = re.compile("\[(.*)\]") matches = [] for filepath in glob.iglob(search_path, recursive=True): matching_lines = [] file_kos = [] for i, line in enumerate(open(filepath)): searchterm_matches = re.findall(regex_searchterm, line) if searchterm_matches != []: matching_lines.append(i) ko_matches = re.match(regex_ko, line) if ko_matches: kos = {"ko_name" : ko_matches.group(1), "ko_line" : i} file_kos.append(kos) if matching_lines != []: matching_kos_in_file = [] for matching_line in matching_lines: for i in range(len(file_kos)): is_match = False if i == len(file_kos)-1: is_match = True else: next_ko_line = file_kos[i+1]["ko_line"] if next_ko_line >= matching_line: is_match = True if is_match: matching_ko = file_kos[i]["ko_name"] if matching_ko not in matching_kos_in_file: matching_kos_in_file.append(matching_ko) file_match = {"filepath": filepath, "kos": matching_kos_in_file} matches.append(file_match) return matches def main(args=None): parser = get_parser() args = parser.parse_args() matching_files = get_matching_files(search_term=args.search_term) print("Searching for {}".format(args.search_term)) for matching_file in matching_files: print("File {} contains following KOs:".format(matching_file["filepath"])) for matching_ko in matching_file["kos"]: print(matching_ko) if __name__ == "__main__": main()   ... View more

This was a great example of a metrics input from a CSV file! We've added it to the metrics documentation: http://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/GetMetricsInOther#Example_of_a_CSV_file_metrics_input We have also updated this topic to clarify the CSV file format requirements for this kind of metrics input. ... View more

Hello and thanks for this. I really appreciate you taking the time to answer. ..j ... View more

(So happy to see @Damien Dallimore !) Self Serving answer: I would recommend the "Best Practices and Better Practices" breakout sessions at conf that I do. I think we cover all the topics you asked about. If you won't be at this years conf, you can still find recordings from last years online. In my current role at Splunk, I'll be working to formalize those items and get them published in appropriate places (or in the product). So, it might take time but you'll soon see more in this domain! ... View more

I guess you could edit $SPLUNK_HOME/etc/system/local/savedsearches.conf and add: schedule_window = auto Just make sure your existing searches that need a specific setting of 0, 1 etc have that set already. All searches you add after this change should now have auto set by default. You will need to teach your users that auto is a bad setting in certain situations. ... View more

Hi @lyndac - Did your answer above provide a solution to your question? If yes, don't forget to click "Accept" to close out your question. Thank you. ... View more

Ah, looks like someone beat me to this response! ... View more

Does skipped mean skipped bucket verification or skipped as in bucket does not qualify? ... View more

Not in 6.0, unfortunately. That's why the additional capability was added in v6.1--with that you can take away report acceleration and still schedule searches. ... View more

The data model storage path/tstatsHomePath for all indexes by default points to volume:_splunk_summaries/$_index_name/datamodel_summary so it's just a matter of changing the storage path of the _splunk_summaries volume: My preferred way of changing the default behaviour is the following: In $SPLUNK_HOME/etc/system/local/indexes.conf: [volume:_splunk_summaries] # 60 GB maxVolumeDataSizeMB = 60000 # Preferred partition for summaries path = /splunk_summaries This way you change the default location of the _splunk_summaries volume out of the Splunk home dir and you won't have to change it per index. If you want more granular control per index you'd have to change tstatsHomePath for each one as stated in the other answer. ... View more

This is in response to your comment to rsennett.... First off, if you haven't tried the Data Model and Pivot Tutorial, you probably should. I think it would answer many of your questions. If you have tried it and you're still confused, here's another brief tutorial that hopefully will clarify things. You should be able to build a fairly simple data model that delivers the results you need, given the example you've provided. You'd start by creating a data model that consists of one event-based object. Name the object "Sales." Give it a constraint that isolates the events where a revenue-generating sale occurred, such as Sale_Point = * (I'm assuming this provides the location or store name where something was sold). Assuming the four fields are automatically extracted, add them to the object as auto-extracted attributes: Customer , Amount , Sale_Point . (Date should be added automatically as _time unless it's different from the event timestamp.) Make sure that the attribute types are correctly identified: Customer and Sale_Point are strings and Amount is a number. That should be all you need to do. Save your changes. To accelerate the data model go to the Data Model Manager page (it says "Data Models" at the top and has an Actions column; you get to it from the Data Model Editor page by clicking "Back to Data Models"). Click Edit and select Edit Permissions. Share the object with the App or All Apps. (Only shared objects can be accelerated.) Click Edit again and click Edit Acceleration. In the Edit Acceleration dialog select Accelerate and then select a Summary Range. Summary range is the amount of time that you need to be accelerated. The bigger the range, the more space the acceleration summary will take up on disk and the longer it will take to create, so don't choose a range that is longer than you need it to be. For example, if you don't plan to search over more than the last week or two, select a range of 1 Month. Save your acceleration changes. Your model is now accelerated. Now open the object in Pivot. When you go in, straight away it will give you a count of your events with a Sale_Point value over all time (the column will be titled "Count of Sales"). You can adjust the time filter to search over a shorter time range if you don't need all that data (ideally you should cut it down to within your acceleration Summary Range). In Pivot you can fiddle around to get the charts you're interested in. For example, you could add a Split Row element for the Sale_Point attribute and then replace the "Count of Sales" Column Value element with one that sums up Amount . This would give you the total sum of sales by sale point. Or you could set up a Split Row element for the Customer attribute instead and get the total sum of sales by customer. And then you could use the Filter element to filter out all results but those for a specific sale point or customer (if you wanted to). Hopefully this helps! ... View more

I'll try to keep this ball rolling. 🙂 ... View more

Data models are stored on disk as JSON files, and they have associated configs in datamodels.conf and metadata in local.meta (for models that you create) and default.meta (for models delivered with the product). Models that you create are stored in <yourapp>/local/data/models while models delivered with the product can be found in <myapp>/default/data/models. Currently there's no easy way to export data models from one app to another; you'll have to do it by hand, which means at least copying over the JSON file and the related stanza in datamodels.conf . You should also move over the related local.meta material for the datamodel as well. If you no longer want to see the data model in the originating app you should delete the data model from that app via the UI (or, by hand, delete the JSON file and remove the related stanza in datamodels.conf ). For more information see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managedatamodels#Manual_data_model_management As for pivots, to export them save them as a report; this will create a stanza in savedsearches.conf which you can copy over to the savedsearches.conf for your new app. You'll want to do this after you move the data model over, of course. ... View more

The order of views / dashboards is based on the file name on disk. The file name won't affect the name shown in the nav menu - that is set within the file by your label. Numerically prefixing each dashboard / view name is the simplest case, and is easy to make a naming convention for using in sub-menus etc also. Eg for a flat life "01_hits_over_time.xml" "02_less_important_hist.xml". For sub-menus something like "apache-01-hits.xml", "apache-02-errors.xml" "os-01-syslog.xml" "os-02-secure.xml" ... You can't easily rename views/dashboards via Splunk Web [you need to clone, set new name, then delete the old]. Remember when you move, or add/modify, files via the file-system you need to fully refresh the app for the files to get re-read [click the splunk logo top right is the simplest way, or set your location bar to the base of your app eg yoursplunkserver/app/yourapp/] ... View more

I could use eval to map it to a variable is the value is null index=savvis-varnish source="/flocal/logs/lawyers.findlaw.com/search-mapping.log" earliest=-0mon@mon| eval Practice_Area=if(isnull(PAMapped),"Not Mapped",urldecode(PAMapped)) But now how do I use eval to display only those log lines that have Practice_Area="Not Mapped" ... View more

Docs are updated with this info, http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Manageacceleratedsearchsummaries#Use_the_Report_Acceleration_Summaries_page. Thanks, mattness! ... View more

I created a new role as admin 'act_admin'. I added the stanza to $SPLUNK_HOME/etc/apps/search/metadata/local.meta [manager/accesscontrols] access = read : [ admin, act_admin ], write : [ admin ] I restarted the service, then added 'edit_user' to the act_admin role which also includes the 'user' role. As a user in act_admin I can now see the users but the 'default app inherited from' coloumn shows '[PROCESSING ERROR]'. The user role and the act_admin role both have 'search' as the default app. Is there something else to check/modify to correct the 'PROCESSING ERROR'? ... View more

Thank you. ... View more