index=_internal sourcetype=splunk_python sendemail ERROR
0 comments
index=_introspection component=Hostwide | bin _time span=1d | stats values(data.splunk_version) by _time, host
0 comments
index=_audit action=search search=* user!=splunk-system-user provenance!=scheduler | table _time user search host total_run_time result_count | sort - _time
0 comments
| rest splunk_server=local /services/deployment/server/serverclasses | table title whitelist* blacklist*
0 comments
| rest splunk_server=local /services/deployment/server/clients | eval now=now(), diffTime=now-lastPhoneHomeTime, lastPhoneHomeTime=strftime(lastPhoneHomeTime,"%b %d, %Y %H:%M:%S") | search diffTime>86400 | table hostname ip instanceName utsname package splunkVersion lastPhoneHomeTime
0 comments
| rest splunk_server=local /services/deployment/server/clients | table hostname ip instanceName utsname package splunkVersion
0 comments
| rest splunk_server=local /services/deployment/server/applications | search serverclass=* | table title serverclasses stateOnClient
0 comments
| rest /services/apps/local | search disabled IN ("false",0)| table title version description splunk_server
0 comments
index=_internal sourcetype=splunkd earliest=-7d latest=now component=BucketMover | rex field=bkt "/opt/splunk/var/lib/splunk/cold(?<frozen_index>[^/]+)" | stats count by frozen_index
0 comments
index=* | stats count by _raw, index, sourcetype, source, host | where count>1
0 comments