Thank you sgarvin55 for the details about this workaround. It still seems to be an issue with current versions. Does anyone has seen this behaviour for scheduled reports based on complex dashboards which obviously make use of splunkweb as client as well? These reports apparently make GET requests instead of POST as I found them clearly in the logfiles at scheduled time: 127.0.0.1 - splunk-system-user [26/Oct/2013:16:00:10.070 +0200] "GET /services/pdfgen/render?now=1382796000&owner=admin&input-dashboard=my_report_name&namespace=my_app_name&paper-size=a4 HTTP/1.0" 200 131705 - - - 3156421ms As we can see they have a long execution time for almost 1h. I'm also playing with the SPLUNKD_CONNECTION_TIMEOUT setting right now... The odd thing is that the same reports sometimes run fine and sometimes just timeout with an HTTP 400 bad request: 127.0.0.1 - splunk-system-user [29/Oct/2013:16:04:14.279 +0100] "GET /services/pdfgen/render?owner=admin&input-dashboard=my_report_name&now=1383058800&namespace=my_app_name&paper-size=a4 HTTP/1.0" 400 250 - - - 127281ms btw: you should divide the spent time in your search by 1000 to get the correct amount of seconds 😛 regards alex ... View more

here is an example of the sourcenames.csv: source, sourcename /DIR1/* /DIR2/* /DIR3/*, Site with multiple values We tried to put it in quotation marks also. The $target$ always ends up in the search like this: uri="/DIR1/* /DIR2/* /DIR3/*" What we need is this: uri="/DIR1/" OR "/DIR2/" OR "/DIR3/*" ... View more

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership ... View more

You can use A records in DNS as much as you want, no point of using aliases. Aliases might work, but A records are cleaner. ... View more