Thanks for investigating and giving assistance for a less-intrusive workaround for this issue. ... View more

I experienced the exact same issue (Splunk 7.0.3 and also after upgrade to 8.0.1). I was able to fix by reset/reconfigure the DMC. "Settings" -> "General Setup" - > "Reset All Settings"... and then reconfigure the DMC." ... View more

Please update https://docs.splunk.com/Documentation/Splunk/7.2.6/ReleaseNotes/Knownissues Description of impact/defect is not clear. We have several customers relying on scheduled pdf - not working for some (upgraded installations). ... View more

Observed this issue with Splunk 6.6.3. We saw, that a dashboard using scheduled reports for panels kept on running the searches and not using the last result from schedule. Problem is related to the frequency of the scheduled report. Seems like you need at least 2 completed scheduled searches for the dashboard to show the pre-searched results. The problem can be identified simply by running search: | loadjob savedsearch=":: Which then would fail to show results of last scheduled search run. We use Splunk for some monthly reports, where there usually always are only one result of the scheduled search available (present in dispatch-dir). Workaound is to have the schedule run the report twice within the month. Eg. 01:00am and 02:00am on the first date of month. We do not see the issue in Splunk version 7.0.0 The problem has been reported to Splunk (support-case #531503). ... View more

Can also be done in the same lookup definition as.. example: [MandiantAPT] filename = mandiant-apt.csv case_sensitive_match=false match_type = WILDCARD(domain),WILDCARD(filename) ... View more

inputs.conf [jmx://jboss_eap] config_file = config.xml polling_frequency = 60 sourcetype = jmx index = test disabled = false config.xml <jmxpoller> <formatter className="com.dtdsoftware.splunk.formatter.TokenizedMBeanNameQuotesStrippedFormatter" /> <!-- Connect to a JVM via the remote JMX interface --> <jmxserver host="localhost" jmxServiceURL="service:jmx:remoting-jmx://localhost:4547" jvmDescription="JBOSS" jmxport="4547" jmxuser="username" jmxpass="password"> <!-- dump all the attributes of every mbean--> <!-- <mbean domain="*" properties="*" dumpAllAttributes="true" />--> <!-- dump all the attributes of every mbean in the java.lang domain--> <!-- <mbean domain="java.lang" properties="*" dumpAllAttributes="true"/>--> <mbean domain="java.lang" properties="type=Threading"> <!-- simple attributes --> <attribute name="TotalStartedThreadCount" outputname="started"/> <attribute name="ThreadCpuTimeSupported" outputname="cpuTimeSupported"/> <attribute name="ThreadCpuTimeEnabled" outputname="cpuTimeEnabled"/> <attribute name="ThreadCount" outputname="count"/> <attribute name="ThreadContentionMonitoringSupported" outputname="cmSupported"/> <attribute name="ThreadContentionMonitoringEnabled" outputname="cmEnabled"/> <attribute name="SynchronizerUsageSupported" outputname="synchSupported"/> <attribute name="PeakThreadCount" outputname="peak"/> <attribute name="ObjectMonitorUsageSupported" outputname="omuSupported"/> <attribute name="DaemonThreadCount" outputname="daemonCount"/> <attribute name="CurrentThreadUserTime" outputname="currentUserTime"/> <attribute name="CurrentThreadCpuTimeSupported" outputname="cpuTimeSupported"/> <attribute name="CurrentThreadCpuTime" outputname="currentCPUTime"/> </mbean> <mbean domain="java.lang" properties="type=Runtime"> <!-- tabular attributes --> <attribute name="SystemProperties:user.timezone:value" outputname="timezone"/> <attribute name="SystemProperties:java.vm.vendor:value" outputname="jvmVendor"/> <!-- simple attributes --> <attribute name="VmVersion" outputname="jvmVersion"/> <attribute name="VmVendor" outputname="jvmVendor"/> <attribute name="VmName" outputname="jvmName"/> <attribute name="Uptime" outputname="jvmUptime"/> <attribute name="StartTime" outputname="startedAt"/> <attribute name="Name" outputname="jvmProcessName"/> <!-- simple array attribute --> <attribute name="InputArguments" outputname="inputArgs"/> </mbean> <mbean domain="java.lang" properties="type=OperatingSystem"> <!-- simple attributes --> <attribute name="Version" outputname="version"/> <attribute name="TotalSwapSpaceSize" outputname="swapSpace"/> <attribute name="TotalPhysicalMemorySize" outputname="physMem"/> <attribute name="SystemLoadAverage" outputname="sysLoad"/> <attribute name="ProcessCpuTime" outputname="cpuTime"/> <attribute name="OpenFileDescriptorCount" outputname="openFD"/> <attribute name="Name" outputname="name"/> <attribute name="MaxFileDescriptorCount" outputname="maxFD"/> <attribute name="FreeSwapSpaceSize" outputname="freeSwap"/> <attribute name="FreePhysicalMemorySize" outputname="freePhysMem"/> <attribute name="CommittedVirtualMemorySize" outputname="committed"/> <attribute name="AvailableProcessors" outputname="processors"/> <attribute name="Arch" outputname="arch"/> </mbean> <mbean domain="java.lang" properties="type=Compilation"> <!-- simple attributes --> <attribute name="TotalCompilationTime" outputname="time"/> </mbean> <mbean domain="java.lang" properties="type=ClassLoading"> <!-- simple attributes --> <attribute name="TotalLoadedClassCount" outputname="total"/> <attribute name="LoadedClassCount" outputname="current"/> <attribute name="UnloadedClassCount" outputname="unloaded"/> </mbean> <mbean domain="java.lang" properties="type=Memory"> <!-- composite attributes --> <attribute name="NonHeapMemoryUsage:used" outputname="nonHeapUsed"/> <attribute name="NonHeapMemoryUsage:max" outputname="nonHeapMax"/> <attribute name="NonHeapMemoryUsage:init" outputname="nonHeapInit"/> <attribute name="NonHeapMemoryUsage:committed" outputname="nonHeapCommitted"/> <attribute name="HeapMemoryUsage:used" outputname="heapUsed"/> <attribute name="HeapMemoryUsage:max" outputname="heapMax"/> <attribute name="HeapMemoryUsage:init" outputname="heapInit"/> <attribute name="HeapMemoryUsage:committed" outputname="heapCommitted"/> <attribute name="ObjectPendingFinalizationCount" outputname="objectsPending"/> </mbean> <mbean domain="java.lang" properties="type=MemoryPool,name=*"> <attribute name="Name" outputname="name"/> <attribute name="Type" outputname="memoryType"/> <attribute name="MemoryManagerNames" outputname="memManagerNames"/> <attribute name="PeakUsage:used" outputname="peakUsageUsed"/> <attribute name="PeakUsage:max" outputname="peakUsageMax"/> <attribute name="PeakUsage:committed" outputname="peakUsageCommitted"/> <attribute name="PeakUsage:init" outputname="peakUsageInit"/> <!-- fubar --> <!-- composite attributes <attribute name="CollectionUsage:used" outputname="colUsageUsed"/> <attribute name="CollectionUsage:max" outputname="colUsageMax"/> <attribute name="CollectionUsage:committed" outputname="colUsageCommitted"/> <attribute name="CollectionUsage:init" outputname="colUsageInit"/> --> <!-- composite attributes --> <attribute name="Usage:used" outputname="usageUsed"/> <attribute name="Usage:max" outputname="usageMax"/> <attribute name="Usage:committed" outputname="usageCommitted"/> <attribute name="Usage:init" outputname="usageInit"/> </mbean> <mbean domain="java.lang" properties="type=GarbageCollector,name=*"> <!-- simple array attributes --> <attribute name="Name" outputname="gcName"/> <attribute name="MemoryPoolNames" outputname="memPools"/> <!-- simple attributes --> <attribute name="CollectionTime" outputname="colTime"/> <attribute name="CollectionCount" outputname="colCount"/> <!-- composite-simple attributes --> <attribute name="LastGcInfo:startTime" outputname="gCStart"/> <attribute name="LastGcInfo:endTime" outputname="gCEnd"/> <attribute name="LastGcInfo:id" outputname="gCID"/> <attribute name="LastGcInfo:duration" outputname="gCDuration"/> <attribute name="LastGcInfo:GcThreadCount" outputname="gCThreadCount"/> <!-- composite-tabular-composite-simple attributes --> <!-- Detailed GC Info for the various heap and non-heap memory pools. I've included an example of extracting "Eden Space" & "Survivor Space" attributes for HOTSPOT JVM with default GC setup, its just a copy paste exercise for the other pools Perm Gen Perm Gen [shared-ro] Perm Gen [shared-rw] Eden Space Survivor Space Tenured Gen etc... Based on which GC collector and policy you use and which JVM, these memory pool names may differ. <attribute name="LastGcInfo:memoryUsageBeforeGc:Eden Space:value:used" outputname="eden_beforeGCUsed"/> <attribute name="LastGcInfo:memoryUsageBeforeGc:Eden Space:value:max" outputname="eden_beforeGCMax"/> <attribute name="LastGcInfo:memoryUsageBeforeGc:Eden Space:value:init" outputname="eden_beforeGCInit"/> <attribute name="LastGcInfo:memoryUsageBeforeGc:Eden Space:value:committed" outputname="eden_beforeGCCommitted"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Eden Space:value:used" outputname="eden_afterGCUsed"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Eden Space:value:max" outputname="eden_afterGCMax"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Eden Space:value:init" outputname="eden_afterGCInit"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Eden Space:value:committed" outputname="eden_afterGCCommitted"/> <attribute name="LastGcInfo:memoryUsageBeforeGc:Survivor Space:value:used" outputname="survivor_beforeGCUsed"/> <attribute name="LastGcInfo:memoryUsageBeforeGc:Survivor Space:value:max" outputname="survivor_beforeGCMax"/> <attribute name="LastGcInfo:memoryUsageBeforeGc:Survivor Space:value:init" outputname="survivor_beforeGCInit"/> <attribute name="LastGcInfo:memoryUsageBeforeGc:Survivor Space:value:committed" outputname="survivor_beforeGCCommitted"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Survivor Space:value:used" outputname="survivor_afterGCUsed"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Survivor Space:value:max" outputname="survivor_afterGCMax"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Survivor Space:value:init" outputname="survivor_afterGCInit"/> <attribute name="LastGcInfo:memoryUsageAfterGc:Survivor Space:value:committed" outputname="survivor_afterGCCommitted"/> --> </mbean> </jmxserver> </jmxpoller> ... View more

Splunk App for Unix 5.0.1 Splunk Add-on for *nix 5.0.2 I also did a downgrade to the Add-on version 5.0.1 (which is the version supplied along with the App). Same results. We have a customer with the same issue - actually on CentOS-installation. I think I will ask Splunk Support for some assistance here.. and post any updates here of course. ... View more

Currently it states in Splunk For Unix-appn that my instance has "71.00 cores" just as this search also returns 71.00 cores: index=os source=cpu host=palle-virtual-machine NOT cpu="all" | append [stats count | eval _raw="no results"] | head 100 | eval name="CPU:" | stats first(name) as name max(CPU) as cpus | eval cpus=if(isnum(cpus), tostring(cpus + 1) + " cores", "unknown - is cpu.sh enabled?") ... View more

Output of cpu.sh ~/splunk/bin$ ./splunk cmd ../etc/apps/Splunk_TA_nix/bin/cpu.sh CPU pctUser pctNice pctSystem pctIowait pctIdle 1.01 0.00 1.01 1.01 0.00 96.97 1.01 0.00 1.01 1.01 0.00 96.97 cat /proc/cpuinfo | fgrep -c processor 1 ... View more