I downvoted this post because the min free space error has nothing to do with the max search disk size. ... View more

The files of a search will be deleted when the lifetime of it expires (after a few minutes). Your folder has a minimum free space configuration which has expired for this particular folder. The same propably applies to the whole splunk directory. You can reduce the minimum free space for the splunk folder in server.conf [diskUsage] minFreeSpace = <num> The question has been asked at: https://answers.splunk.com/answers/214804/the-minimum-free-disk-space-5000mb-reached-for-opt.html and was answered allready. ... View more

Thanks for the clarification. I had the same question as your presentation and overview app state "With the launch of 6.4 you'll have access to over 12 new advanced visualizations" which is not the case. ... View more

Hi bankze, I'm sorry but I'm not able to teach JS over Splunk Answers. Use this as a guideline and notice the comment from my coworker regarding the require function: https://answers.splunk.com/answers/319267/how-do-i-correctly-use-leaflet-maps-in-splunk-63.html ... View more

Hi bankze, if you want to use any custom map on splunk, leaflet would be the easiest implementation as it is included. For easy presentation of your map no javacode is necessary. In the conference paper you see a custom map example on page 24 realised with splunk settings. You could use a script to create the tiles from your drawn map (automated process) and put them in the static directory of your app. As URL for the map tiles (in folder /static/tiles/) you then give splunk http://your_ip:8000/en-US/app/your_app_name/tiles/{z}/{x}/{y}.png and can use the splunk given features for map representation. All you need to do is give splunk your coordinates as latitude and longitude. If you want custom data presentation methods I'd recommend a newer version of leaflet together with JS. Most plugins won't work with the version splunk implemented years ago from my experience. Regarding the other questions: Simple XML would not be enough for your task. It's an easy way to create custom dashboards with splunk given commands. CSS would be possible but is more complicated than predefined modules and plugins. There is no custom dashboard function I know of which would allow you to draw a picture and present data on it prebuilt in splunk. ... View more

Leaflet would allow you to use a custom map. You'd need to look for a plugin which allows the representation style you prefer or write your own overlay. This would require a custom dashboard with javascript-code. You also need to watch out for this problem if you are using 6.3.3.: https://answers.splunk.com/answers/319267/how-do-i-correctly-use-leaflet-maps-in-splunk-63.html and I recommend using a newer version of leaflet than the one provided with splunk. There are scripts which will split your custom drawn map in the right tiles and create the folder structure you need. There is a small presentation regarding maps in splunk from .conf2015. You can look at the custom tile server url and create a solution with your own, script-generated tiles. https://conf.splunk.com/session/2015/conf2015_RBittner_MPorath_Splunk_UsingSplunkSearchLanguage_GettingStartedwithMaps_FINAL.pdf ... View more

Luckily someone else had the exact same question: https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html ... View more

Making the lookup automatic would allow you to pull the limitation "search id="1"" into the base search which should speed things up. ... View more

I'm not quite sure what you mean but I get login attempts with user name. Why should the action="login attempt" prompt saved searches information? If you want to see the hosts as well expand with index=_audit action="login attempt" info=failed | table _time user host ... View more

You'd need a lookup table to make that work which only can be used at search time, not when the host field is written. An automated lookup should be enough to adress your issue: http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Makeyourlookupautomatic ... View more

In this case a timechart would be better, for example: | timechart span=1h count(foo) if you want to plot all events with the field foo each hour or | timechart span=1h count(foo) by username if you want to see a line for each username. ... View more

The missing backslash in your filepath could cause problems. ... View more