Anyone having slowness/freezing issues with the interface with every entity you add? ... View more

After upgrading my search heads to splunk6 and even on a fresh install I get the following error on setting up LDAP. Worked prior to the upgrade and I can even restore Splunk5.0.3 and it works. Does anyone know of any bugs or needed changes to fix the issue? Encountered the following error while trying to update: Splunkd daemon is not responding: (u'Error connecting to /servicesNS/nobody/system/authentication/providers/LDAP/tmobile: The read operation timed out',) ... View more

Can somebody give me a clue on what my url would be if I do a search with outputcsv results.txt? I know where it goes on the server just not sure what the default url is for things located in var/run/splunk...... Thanks ... View more

I am trying to setup a dashboard with the following example search. What I need to do is have both id and or name, I tried it with just OR but if it matches on the first it will not continue on the second and it breaks with AND OR...? index=someindex id=* AND OR name=* ... View more

I am building a dashboard and have a question? I have custom time search the produces a log output that I need to do a search against a different log within the time listed at the begging of the log and the end of the log of the times list in the results. Does anyone know how I would how I would do a new search based off of that to post the output of all logs between that time frame? OUTPUT: <?xml version="1.0" encoding="UTF-8" standalone="no"?> <call ani="" applicationName="POSTPAID" applicationVersion="1.0" callerType="postpaid" dnis="" duraction="2:12.223" id="servername-2013-01-08-16-09-04-114-L34-C528659411" line="34" mediaserver="servername" startTime="2013-01-08 16:09:04.193"> <jsFunction id="PO9035_CheckDirectXfer_BC" index="55" result="PO9035_BC: exitState=SPEAK_FREELY]" startTime="2013-01-08 16:11:16.416"/> <endcall cleanup="true" disconnect="false" id="endCall" index="56" language="en-US" speaker="0" startTime="2013-01-08 16:11:16.416"/> </states> </call> The Time Frames above would be - **2013-01-08 16:09:04.193 2013-01-08 16:11:16.416** ... View more

So I added a new index and without thinking I hit submit without changed db info. I restarted and now I can get splunk up as you can see below. Anyone know how to remove an index reference with splunk not running? root@atpscld1>/opt/splunk/bin/splunk start Splunk> 4TW Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Problem parsing indexes.conf: The homePath "/opt/splunk/var/lib/splunk/defaultdb/db" of index "nms" is repeated multiple times (already specified as homePath of index "main"). Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue root@atpscld1> root@atpscld1>/opt/splunk/bin/splunk disable index nms Splunk is not running, and it must be for this operation. To start splunk, run "splunk start". root@atpscld1> ... View more