Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: $decideOnStartup how to determine the name of ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We started using Splunk deployment server after some Windows servers already had the universal forwarder installed. However, it seems some servers were installed without the Splunk UniversalForwarder being configured correctly. Currently the $decideOnStartup "host" is reporting performance metrics, but I don't see any applog, seclog, or syslog data. I know that doesn't mean the server isn't reporting any data for the logs, I just don't have any data since the Splunk history was truncated to 35 days ago.
Is there an easy way to determine what server has the messed up configuration?
At the moment, I think I will be comparing the "All Forwarers" report from the Deployment Monitor Application and
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run this search with a timeframe of 24-48hrs, and look for missing sourcetypes and or servers:
index=main sourcetype="*security" OR sourcetype="*application" OR sourcetype="*system" | stats count by host,sourcetype
If you are missing servers or source types, then check those servers to verify the forwarder configuration, and that they are configured for auditing. Windows auditing is minimal by default and must be configured by the administrator.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run this search with a timeframe of 24-48hrs, and look for missing sourcetypes and or servers:
index=main sourcetype="*security" OR sourcetype="*application" OR sourcetype="*system" | stats count by host,sourcetype
If you are missing servers or source types, then check those servers to verify the forwarder configuration, and that they are configured for auditing. Windows auditing is minimal by default and must be configured by the administrator.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry applog, syslog, seclog were short for: WinEventLog:Application, WinEventLog:Security, WinEventLog:System
No its a linux Deployment Server.
Splunk version 5.0.1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The applog, syslog, and seclog sound like unix log files. If you are configuring these boxes from a Windows box then you may have format and or permission problems.
Are you using a Windows deployment server for Linux hosts?
What version of Splunk are you running?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
