The  "top" example worked for me instead. eventstats didn't make sense ... View more

Where is that documented? I have many sourcetypes starting with a pattern sm_* could I set [(^:::){0}sm_*] fieldalias-myfirst = myFirst AS myLast ... To apply the fieldalias to all the sourcetypes starting with sm_ ? ... View more

LDAP failover must have made tracks all over your radar screen by now. We're tuned. Only hearing static. When's the music going to start? ... View more

I figured out what was causing my issue. While I would create the extraction in an application and set it to all applications & give read only to everyone; the user also needs to have at least read only access to the application that the extraction is in. So I usually create all global objects in the Search application because Splunk 4.1.6 beta has a lot of references to this application so I've had nothing but issues with disabling this app anyway. Then I give all roles at least read only access to the search application. Another option is to add these to the system app. ... View more

Since you indicated that christopherutz's answer did indeed answer your question, please accept his answer by clicking the green checkmark next to it so this question can be closed out. Thanks ... View more

Oh and Splunk internally is working on a forwarder monitoring app to be released soon. ... View more

Updated my answer. Indeed the Flash Chart doesnt know what the search language was - it just graphs the rows and columns it's given, so the combination of bucket and stats dc(fieldA) by _time, fieldB will work just fine in the chart. ... View more

it doesnt make much sense why we did it this way, but the "events" are limited at 10K (or possibly 50K I forget), but as of 4.1.4 or so the reporting commands like stats will actually output ALL rows. So the postProcess limitation where the rows get truncated only applies when it's literally events that make up the rows. ... View more

Blockquote| eval wd=lower(Day) | eval sort_field=case(wd=="monday",1,wd=="tuesday",2,wd=="wednesday",3,wd=="thursday",4,wd=="friday",5,wd=="weekend",6) | sort sort_field | fields - sort_field ฺbeside you ,change sort_filed to my field name ,What else I change wd value to my field name too ? ... View more

I was having a similar issue (see Log File Not Breaking Correctly) This solved my problem: time_before_close = <integer> * Modtime delta required before Splunk can close a file on EOF. * Tells the system not to close files that have been updated in past <integer> seconds. * Defaults to 3. ... View more

Thanks, I will get with my CT group to make sure the umask is set before they perform future splunk installations using puppet. ... View more

I think you could further refine this so that you are only blocking the sourcetype rename by changing [props] to [props/new_sourcetype_name/rename] , just FYI. This would be helpful if you need other props.conf settings but simply wanted to block the rename itself. ... View more