I don't know if you can do it without rangemap. If you haven't already, take a look at the Traffic Light Visualisations App. Good examples there. ... View more

Check your splunk-launch.conf file for, 'SPLUNK_BINDIP = '. Comment this out if present and restart splunk, it worked for me. I've submitted case #268017 regarding this. ... View more

I've also seen issues in our clustered environments where simply adding a new index sometimes triggers a reload and other times triggers a restart. ... View more

Reload occurs when: You add a new sourcetype in props.conf. You add or update any TRANSFORMS- stanzas in props.conf. You add any new stanzas in transforms.conf. You make any of these changes in indexes.conf: Adding new index stanzas Enabling or disabling an index with no data Changing any attributes not listed as requiring restart Restart occurs when: The configuration bundle contains changes to any configuration files besides indexes.conf, props.conf, or transforms.conf. You make any changes to props.conf or transforms.conf, other than those specified in the reload list, above. You make any of these indexes.conf changes: Adding or removing a volume Enabling or disabling an index with data Removing an index Changing any of these attributes: homePath, coldPath, thawedPath, bloomHomePath, summaryHomePath, tstatsHomePath, repFactor, rawChunkSizeBytes, minRawFileSyncSecs, syncMeta, maxConcurrentOptimizes, coldToFrozenDir http://docs.splunk.com/Documentation/Splunk/6.2.5/Indexer/Updatepeerconfigurations#Restart_or_reload_after_configuration_bundle_changes.3F ... View more

Same here though, I'm connecting to an oracle DB. I can bypass the GUI and add the config directly to the $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/inputs.conf and the input works just fine. The rpc.log gives nothing, even when configured for DEBUG. ... View more