On Preview 3 Solaris/SPARC it seems like the search modifiers maxresults and readlimit do not work.
Without those modifiers, a few events are returned.
For the webinterface, maxresults works, but only through the preferences menu.
Forums: SplunkPreview: Search modifiers
Previous Topic: Windows: splunkd crashes when using UDP network inputs | Next Topic: multikv.conf example
Posts 1–2 of 2
| Post to this topic
Stranger than fiction...
I tried a simple [tail:///var/adm/messages] in a separate bundle.
The content is indexed, but a search is not returning anything.
Tried the same on 3.1.5, where it works.
A quick check on splunklogs did not reveal anything...
Maybe related to the bug in my first post.
Post to this topic
You must be logged in to post a reply.