We have fixed this with release 6.5.7, 6.6.5 and 7.0.2 ... View more

You need to use -d actions="". Example this creates the search with alert: curl -ku admin:matteo https://127.0.0.1:8089/servicesNS/admin/search/saved/searches/ -d name=zzzsrch -d search=* -d is_scheduled=1 -d cron_schedule="*/2 * * * *" -d actions=email -d action.email.to="zzz@ssss.com" | grep -E "action.email\"|action.email.to" This disable the alert: curl -ku admin:matteo https://127.0.0.1:8089/servicesNS/admin/search/saved/searches/zzzsrch -d actions="" | grep -E "action.email\"|action.email.to" ... View more

This seems to do the trick ! index=_internal source=*splunkd.log earliest=-20d | eval bytes=length(_raw) | eval WTime=strftime(_time,"%W") | eval userLabel=WTime | eval dateday=date_mday."_".date_month."_".date_year | stats max(bytes) as max by userLabel, dateday | eval userLabel="WeekYear=".userLabel | streamstats count by userLabel | eval userLabel=case(count==1,userLabel,count>=2," ") | table userLabel,max ... View more

Nice one, I simpler application of this answer: index=_internal source=*splunkd.log earliest=-2d | eval bytes=length(_raw) | eval WTime=strftime(_time,"%W") | eval userLabel=WTime | eval dateday=date_mday."_".date_month."_".date_year | stats max(bytes) as max by userLabel, dateday | eval userLabel="WeekYear=".userLabel | table userLabel, max Alternatively you can also show the day and week together: index=_internal source=*splunkd.log earliest=-2mon | eval bytes=length(_raw) | eval WTime=strftime(_time,"%W") | eval userLabel=WTime | eval dateday=date_mday."_".date_month."_".date_year | stats max(bytes) as max by userLabel, dateday | eval userLabel="WeekYear=".userLabel." DateDay=".dateday | table userLabel, max ... View more

I think there was a problem with copying the regex extraction. The original search should be | rest /services/cluster/master/buckets splunk_server=* | rex field=title "^(?<repl_index>[^\~]+)" | search repl_index="*" standalone=0 frozen=0 | rename title AS bucketID | fields bucketID peers.*.search_state *site* | untable bucketID siteState value | rex field=siteState "peers\.(?<peerGUID>[^\.]*)\.(search_state)" | rex field=siteState "(?<siteState>primaries_by_site)\.(\S+)" | rex field=siteState "(?<siteState>rep_count_by_site)\.(\S+)" | rex field=siteState "(?<siteState>search_count_by_site)\.(\S+)"| eval peerGUID=if(siteState=="primaries_by_site", value, peerGUID) | eval site=if(siteState=="origin_site", value, site) | eval value=if(siteState=="search_count_by_site", site + ":" + value, value) | eval value=if(siteState=="rep_count_by_site", site + ":" + value, value) | eval peerGUID=if(siteState=="primaries_by_site", value, peerGUID) | eval site=if(siteState=="origin_site", value, site) | eval value=if(siteState=="search_count_by_site", site + ":" + value, value) | eval value=if(siteState=="rep_count_by_site", site + ":" + value, value) | join type=outer peerGUID [ rest /services/cluster/master/peers splunk_server=* | fields active_* host* label title status site | eval PeerName= site + ":" + label + ":" + host_port_pair | rename title AS peerGUID | rename site AS peerSite | table peerGUID PeerName peerSite ] | eval site=if(siteState=="search_state", peerSite, site) | eval value=if(siteState=="primaries_by_site", PeerName + ":For_" + site, value) | eval value=if(siteState=="search_state", PeerName + ":" + value, value) | fields - PeerName peerGUID peerSite | chart values(value) over bucketID by siteState ... View more

It is difficult to provide a precise minimum requirement; in fact I would say that try to match the minimum is not a good approach. Maybe you cluster is indexing hundred lines of syslog per day and the minimum will work; maybe it is a multiterabyte environment and therefore the minimum is not enough. I would setup a test environment, make sure a connection can be established and maintained between the two sites; make sure data can be transferred in secure copy in a reasonable time and the vast majority of the packets is not being resent. If already at this stage the cluster does not work clearly there is not point to move forward with this environment ... View more

You might just have a problem of resources. If your system is indeed matching the recommended then you should try again the upgrade, but first stop Splunk ... View more

Please try this search ( from Splunk on Splunk ) index=_internal source=*metrics.log group=tcpout_connections | eval kb=(tcp_Bps*30)/1024 | timechart sum(eval(kb/1024)) as MB ... View more

This is a known issue which will be solved with Splunk 6.2.4 There is an easy workaround to have this working on the current release: 1. mkdir $SPLUNK_HOME/share/splunk/zoneinfo 2. ( Assuming the Indexer is a Linux box ) cp /usr/share/zoneinfo/Hongkong $SPLUNK_HOME/share/splunk/zoneinfo/HKT 3. Restart Splunk. And it will recognize the HKT timezone correctly. ... View more

have you tried it from props.conf? I have two different results between rex search command and props.conf ... View more

This works for me, but it is a bit random. Maybe you have better suggestion? [vmdata] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true KV_MODE = none EXTRACT-vall = (?mis)vendor_description=(?<vendor_descrition>.*)[\r\n]+vendor_observation=(?<vendor_observation>.*(?!vendor))[\r\n]+vendor_recommendation=(?<vendor_recommendation>.*)[\r\n]+ ... View more

Try this : curl -u admin:{{password}} -k 'https://localhost:8089/services/pdfgen/render?input-dashboard={{your_dashboard}}&namespace={{your_namespace}}&paper-size=a4-landscape' >> test.pdf ... View more

try to use the full jdk installation from Oracle. ... View more

try with: {{ WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') AND $rising_column$ > ?}} ... View more

You need to use a eval with case and cover the different combinations. For instance: index=_internal earliest=-15min sourcetype=splunk* | eval log_level=case(date_second<=10,"INFO",date_second<=50,"Warning",date_second<=59,"Fatal") | chart count by log_level | eval range=case((log_level="Fatal" AND count<100), "Low" , (log_level="Fatal" AND count<2000), "Warning") | table log_level,count,range ... View more

inputs.conf is the right place. Check which is the current active configuration with btool: $SPLUNK_HOME/bin/splunk cmd btool --debug inputs list ... View more