Replace <form> with <form version="1.1"> (optionally) <form version="1.1" theme="dark"> ... View more

Hi @_d_,  ./splunk clean eventdata _thefishbucket is wrong command it will delete all data from all indexes in Splunk instance. Please use ./splunk clean eventdata -index  _thefishbucket  to clean the fishbucket only.   ... View more

Thanks, you just helped a noob from losing his mind! ... View more

Yeah, it might be a bug actually. Have a look on this post: http://answers.splunk.com/answers/126064/bug-in-universal-forwarder-inputsconf-monitor-and-recursive-false ... View more

please stop posting comments as new answers. thanks. ... View more

Hi Dark_ichigo, there is no need to so. Take a look at the swap the license master docs. This should give you a picture, how it should be done in case of any license master troubles. You have 24 hours to bring back the master, before you are no longer able to search. Should be long enough to bring back any small VM acting as license master. hope this helps ... cheers, MuS ... View more

We deployed it and it worked fine. Cheers! ... View more

No, you can see for yourself the pool would be having the license available still. Splunk does show up violation error with incompatible sourcetype/source. Kindly contact support team if you are not sure about this. But Deployment monitor app will help you resolving this error as it shows from where it's coming.. ... View more

No, this does not determine whether your scheduled search runs in realtime. Per the saved searches.conf.spec: realtime_schedule = [0|1] * Controls the way the scheduler computes the next execution time of a scheduled search. * If this value is set to 1, the scheduler bases its determination of the next scheduled search execution time on the current time. * If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time. This is called continuous scheduling. ** If set to 1, the scheduler might skip some execution periods to make sure that the scheduler is executing the searches running over the most recent time range. If set to 0, the scheduler never skips scheduled execution periods. However, the execution of the saved search might fall behind depending on the scheduler's load. Use continuous scheduling whenever you enable the summary index option.** * The scheduler tries to execute searches that have realtime_schedule set to 1 before it executes searches that have continuous scheduling (realtime_schedule = 0). * Defaults to 1 ... View more

That worked perfectly for my purpose. I combined data from 2 different days, and shifted the date of the first day so that timechart would show them at the same times, but I ended with an empty set. This solved my problem. Thank you very much! ... View more

Excellent, I'll try it now and then mark your answer is as Correct. Cheers! ... View more

Thanks, that was one of the issues, the other one was that someone had names the stanza in props.conf to the index name instead of the Sourcetype name, now its fixed 🙂 ... View more

actually , 1) is what you are trying to do. 2) is altering the raw events to strip out text. 1) will route off full events you don't want to a null queue if you so desire. In props.conf [yoursourcetype] TRANSFORMS-set= setnull,setparsing In transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = (.+?)ABC_.*|(.+?)> DEST_KEY = queue FORMAT = indexQueue Can you show me an example event , perhaps your regex is wrong ? ... View more

check your cron . for every 5 mins, it should be */5 * * * * and use same approach for other. ... View more

I have been using Splunk for 3 Years now, that is obviously one of the first things I tried, I do get results, but the Summary Index isn't being populated. ... View more

The Universal Forwarder V.4.3.2 has the following as default which I just installed: [thruput] throughput limiting at index time maxKBps = 0 ... View more

Dark_Ichigo, Take a look at the configuration file precedence. It will come in handy when trying to trouble shoot why something works for one user but not another. http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Wheretofindtheconfigurationfiles Local folders are basically read before the defaults. Then what is set in the local files takes priority over the defaults. Think of it as a first in wins. Example: local/limits.conf [thruput] maxKBps = 512 defualt/limits.conf [thruput] maxKBps = 256 Your maxKBps is going to be 512, even though default says 256. It doesn't override it per-say, it ignores it because it is already set. Overriding something, something has to be set before it can be overridden. And with the order the config files are read/loaded, local conf files are before default conf files. ... View more

Thanks, funny thing is that its currently set to 0 in limits.conf, If this will indeed limit how much can be forwarded over the network at once, then my work here is done 🙂 ... View more

I'm going to try creating a cronjob that can monitor Splunks status, but as from what I can see, there doesn't seem to be a perfect (risk free) way of doing this. All other applications I have had to deploy in my lifetime had alarming capabilities for this purpose, as i kinda makes sense to have it. ... View more

I don't think so. http://docs.splunk.com/Documentation/Splunk/latest/admin/outputsconf ... View more

From what I gather, you can do both in the same search. your_search | stats avg(numbers) stdev(numbers) by trans_id If you want it over all events, exclude the by trans_id clause. http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Commonstatsfunctions ... View more

I think its all defined in log.cfg, where you can have 5 splunkd.log each with a maximum size of 24mb. ... View more