Probably the wrong board, choices were limited. In our dev environment we have a 3 node sh cluster, a 3 node idx cluster, an ES sh and a few other anciliary machines (DS, deployer, UF's HF's, LM, CM, etc). All instances use the one LM.  On the SHC we are unable to search, getting the subject line message, yet on the ES SH we can search fine and no error message. The nodes of the SHC are "phoning home" to the LM. Licensing settings (indexer name, manager server uri) have been verified as correct. All nodes show having connected to the LM within the last minute-ish. Not sure where to look from here. ... View more

CONTEXT: I have a group of servers divided into several groups. From the top page, a user makes a choice from a dropdown to get to a dashboard with data from all servers in that group, and from the first drilldown, the user can choose (again from a dropdown) a specific server within the group to open a dashboard with logs specific to the chosen server. The server lists and groups are fairly maleable, so I have set each of the top 2 dashboards to populate the dropdowns dynamically from a lookup table. PROBLEM: When I open the top level dash, 1 to 3 of the 1st drilldown open (in new tabs) and either 3 or 9 of the second drilldown opens. This should happen until a choice is made. top board: <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="group_tok" searchWhenChanged="true"> <label>Bot Category</label> <!-- Dynamic definition of choices --> <search> <query> | inputlookup group_ip_host | dedup group | table group </query> </search> <fieldForLabel>group</fieldForLabel> <fieldForValue>group</fieldForValue> <change> <condition> <link target="_blank"> drilldown1?group_tok=$group_tok$ </link> </condition> </change> </input> </fieldset> 1st drilldown: <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="host_tok" searchWhenChanged="true"> <label>Bot</label> <!-- Dynamic definition of choices --> <search> <query> | inputlookup group_ip_host where group=$group_tok$ | table host </query> </search> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <change> <condition> <link target="_blank">drilldown2?host=$host_tok$</link> </condition> </change> </input> <input type="time" token="timepicker" searchWhenChanged="true"> <label>Search Time</label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> </fieldset> Any idea why I'm getting these extra tabs opened without a choice actually being made? And why in batches of 3? I've tried with autoRun=true and false, submitButton=true and false (obviously not at the same time for each) and I get the same behaviour. ... View more

We are running SE 6.5.4, ES 4.7.1, Splunk_SA_CIM - 4.8.0 I'm getting a discrepancy between 3 searches over the exact same 15 minute period (any given 15 minute period) for the following 3 searches: | tstats count FROM datamodel=Web WHERE Web.action=blocked BY Web.category (test case: 49 results) | tstats summariesonly count FROM datamodel=Web WHERE Web.action=blocked BY Web.category (test case: 44 results) index=XXXX_proxy action=blocked | stats count by category (test case: 49 results) Web datamodel is accelerated, Earliest time as set in CIM setup = 2 month The disparity is not consistent. Sometimes the result count is equal for all 3 searches, sometimes the 2 data model searches are equal and raw is different, etc. This is making us question the validity of our data models, it seems all three result sets should be the same. How should I troubleshoot this? ... View more

Having trouble wrapping my head around the various "times" associated with data model acceleration. In the CIM setup, you have "Earliest Time" which the docs define as "How far back in time the Splunk platform keeps these column stores, specified as a relative time string." Summary range is described in the docs as "Data model acceleration summary ranges span an approximate range of time. At times, a data model acceleration summary can have a store of data that slightly exceeds its summary range, but the summary never fails to meet that range, except during the period when it is first being built." How do these two differ, play together, etc? ... View more

I have a search I'm turning into a panel for a pre-existing dashboard. On that dash I have used snap time successfullynumerous times: <earliest>-6mon@mon</earliest> <latest>@mon</latest> which obviously just gives me the previous 6 calendar months. In this new panel I'm adding, I want the previous 3 calendar months, so I'm using: <earliest>-3mon@mon</earliest> <latest>@mon</latest> No brainer. But it's giving me Nov, Dec, Jan, and Feb 1. wtf??? Any ideas what might be going on here? ... View more