The view recent link launches the jobs manager for that search (by adding a savedSearch= parameter. The jobs manager shows all of the searches that are still cached on disk. Jobs are kept on disk by default for 2 periods, a period being the length of time between runs. So for most scheduled searches you will see 2 results in the jobs manager. This setting is dispatch.ttl in savedsearches.conf, but it is not exposed through the ui due to the potential of quickly filling up disk space if this setting is abused. ... View more

You can try using this search to check your license violations: index=_internal source=*license_audit.log LicenseManager-Audit | delta quotaExceededCount as quotadiff | stats first(quotadiff) as quotadiff | search quotadiff<0 see this forum thread: http://www.splunk.com/support/forum:SplunkSearchAndAlert/3680 ... View more

There will be improvements for this in 4.1, but for now there are a few things you can do. While the long running search is running, click on the jobs link in the top right corner to open the popup jobs manager screen. Your search should be near the top of the list of searches shown there, click the save link, and that will force the job to complete and save a the results data to disk for future use, if you then go back to jobs manager later and click on that search you will be able to get to your search. You can also try setting a key in web.conf in 4.0.x: poller_timeout_interval , in 4.1 there will be a way to turn the poller off and keep alive for ever, but now in 4.0.x you just need to set a very high number there and that should help things, but depending on your data and your search you may still need to use the save method described above. ... View more

No, splunk internal indexes do not apply to your license. ... View more

You can do this through splunk manager. From the manager home page, click on "Server Controls". On this page you will see a green button labeled "Clear restart message", click that button and the messages will go away (they will come back again if you make another configuration change that requires a restart). ... View more

There are good examples for using ldif and ldapsearch on the splunk documentation. http://docs.splunk.com/Documentation/Splunk/5.0/Security/SetupuserauthenticationwithLDAP ... View more

The summary dashboard now shows by default what has been indexed in the past 15 minutes. In order to view all of your sources, sourcetypes and hosts you now have to click the link under all indexed data that says all time, and you will see all of them that have been created over all time. ... View more