I want to get more than 10000 results and after reading some answers about the limits in the email and I realized that if I bump from 10000 to 500000 results I will have a huge file that I will not be able to send by email. So I started to attack this. My first thought was to directly send with a custom alert action. A ptyhon script that emails the results_file through as is easy accessible by the results_file payload but this gives me raw results that I will have to parse (how?). The other alternative is to modify the default email script for my specific app. Any advice ? Is strange that the default email action only sends plain csv files and not give the option of compressing it. ... View more

I can create a new lookup with the admin user and thus create a new collection. When I try to use another user which has permissions to write to the app I get a "You do not have permission to make a KV store collection" message. I just tried to add rest_get and rest_set capabilities but does not work. Update: I've been performing some tests. When you create the lookup from the admin user it creates the collection under $SPLUNK_HOME/etc/apps/appsname/local/collections.conf and under the local.meta it sets the owner to admin user. I have not seen how to change the owner through the UI, so this collection is not usable by any user othen than admin. The api is more specific and tells you need the admin_all_objects capability (aka an admin user) $ curl -k -u poweruser:password -d name=mycollection https://localhost:8089/servicesNS/nobody/myapp/storage/collections/config <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">You (user=poweruser) do not have permission to perform this operation (requires capability: admin_all_objects).</msg> </messages> </response> What's the point to create a collection from the UI if only admin user can use it and you need to modify the files directly to change this behaviour? ... View more

We are upgrading from Splunk 6.1 to 6.3, but the problem we are facing is that now is we are supporting a search head pool with 2 physical servers and 1 virtual with lower hardware. Since each server has its own config, it's not a big deal. We have the virtual out of the balancer and only use it through the API for some apps. With 6.3, if you want a cluster, the minimum number of nodes is 3, but I have read from the docs: "Splunk recommends that you use homogeneous machines with identical hardware specifications for all cluster members. The reason is because the cluster captain assigns scheduled jobs to members based on their current job loads. When it does this, it does not have insight into the actual processing power of each member's machine. Instead, it assumes that each machine is provisioned equally." Is there no way to create a search head cluster where a server has less weight than the others? Is only the scheduled jobs the main problem? ... View more