In our 5.0.2 Splunk version installation we have many simultaneous summary index-populating searches. Sometimes summary indexes are populated in wrong way. For example, summary index A have not only data from saved search populating this index, but also data from another saved search, configurated to populate index B for example. This issue is randomic and not on same indexes. We have already and many times checked events producted from single saved searches and we have not found problems; also in logs there are no errors. Thanks ... View more

Hi, Is is possible for a user other than admin, power user for example, to setup database connections, databases lookups and inputs. I have used default.meta and local.meta settings but a power user can create connections, lookups and etc. only with the admin_all_objects capability. Thanks ... View more

Hi, i have events with microseconds in timestamp, for example 2013-02-13:22:09:43.687263. I see that in custom time setting, in the time range picker of search app, is possible to use only milliseconds, so in my search i lose some events which have difference of microceconds in timestamp. i have used earliest and latest time modifiers at search: sourcetype = mysourcetype timeformat="%Y-%m-%d:%H:%M:%S.%6N" earliest="2013-02-13:22:09:43.687223" latest="2013-02-13:22:09:43.687413" to find events (financial transactions) between the two timestamps, but this search give me no results. In fact in search job inspector i see this: searchEarliestTime 1360789783.687000000 searchLatestTime 1360789783.687000000 so microseconds are not used by search... Is possible to use microseconds in time range? How? Thanks ... View more

I'm writing an app with view and dashboard in advanced xml. If i use accented characters ( à, è, ù and so) in label of view, in nav element of app and in other point , i have an error at startup as this not well-formed (invalid token): and in view or dashboard character is missing. How to include this set of characters? Thanks ... View more

Hi, i'm using saved searches with acceleration enabled in many dashboards.I'd like to cretae a form to summarize searches by input from user. I see that in a form it is possible to use search macros. My question is: is possible to apply acceleration to search macros. If a macros after argument input is the same as a saved search with acceleration, the result is a search with acceleration? Thanks ... View more

Hi, in a free installation today i see in manager > licence section this message: This pool contains slave(s) with 1 warnings ServerSplunkHostName auto_generated_pool_free free pool_warning_count however volume used today is much less than 500mb. What does this message mean? Thanks ... View more

Hi, in a past installation for a wrong choice indexed data are put in main/default index. Now i would change index for my data and use a custom index, for example my_index. How i can put data already indexed in this new index? Thanks ... View more

I have already used lookup table with splunk 4.3 and i have never had problems. With 5.0.1 i have a strange problem. I have this in my ../etc/apps/search/local/props.conf file [mycsv] LOOKUP-calendar = calendar month OUTPUTNEW my_month and in ../etc/apps/search/local/transforms.conf file [calendar] filename = calendar.csv where calendar is in ../etc/apps/search/local/lookups In manager console i have put lookup definition and lookup file objects to global. At search time i have this error: The lookup table 'calendar' does not exist. It is referenced by configuration 'mycsv'. Can you healp me? Thanks ... View more

I have installed splunk on windows 2008 to analyze iis log file. I want to avoid to index log entries with 401 http status code, so i have used props.conf and transforms.conf files. In props.conf i have: [source::C:\\Users\\Administrator\\Desktop\\MyLogFolder\\mylogfile.log] TRANSFORMS-nullcode= setnullcode In transforms.conf file i have [setnullcode] REGEX = 401( [0-9]+){5} DEST_KEY = queue FORMAT = nullQueue However i index log entries with 401 status code. I have verified reg ex and it is all right, infact if i use in props.conf file [host::myhost] TRANSFORMS-nullcode= setnullcode entries with 401 are correctly discarded. Problem is with windows path.... ... View more

hy i have a dashboard with 5 charts, three are pie charts and two bar charts I must change automatic red color of bars of a chart. In xml dashboard, in chart section about bar chartin in exam, i have put <option name="charting.seriesColors">[0xFFFF00,0xFF00FF,0x0000FF]</option> but in visualization of chart i have always automatic red bars Can you help me? Bye ... View more