| | I've got a Win 2008 Web server, and the layout on the disk is as follow: C:\inetpub\sites\www.fqdn.com\logs\ C:\inet... 1 8 | 1 | 8 | |
| | Is it possible to forward data from source A to Indexer A and data from source B to Indexer B if I use the light forw... 2 3 | 2 | 3 | |
| | Hi, I have been using splunk and unfortunately put all data into main index, but because there is a need to allow m... 0 6 | 0 | 6 | |
| | Hi, I am having problems getting Splunk to monitor WebSphere V7. I have enabled PMI on WebSphere and installed Splu... 2 4 | 2 | 4 | |
| | I'm using a scripted input for an application. The script writes warnings to stderr, which makes them show up in splu... 1 1 | 1 | 1 | |
| | My scheduled search: [Summary Logins Per Second] action.summary_index = 1 action.summary_index._name = lgn-stats cro... 0 2 | 0 | 2 | |
| | How to send syslog-ng messages to Splunk properly? I'm using Free 'splunk-4.1.4-82143-linux-2.6-intel.deb' and 'syslo... 3 4 | 3 | 4 | |
| | Is it possible to use the oneshot command from a remote server. Essentially we have a series of logs that are not ab... 0 4 | 0 | 4 | |
| | I have a log, representing data from multiple hosts, with lines like this: 7/30/2010 4:11:52 PM host=OAK06VMH load=5... 1 1 | 1 | 1 | |
| | In other words, can I set 30 days OR 700G (for instance)? The docs aren't clear on how to do that. 0 1 | 0 | 1 | |
| | Hello all, I'm new to Splunk, so please bear with me as I ask a really n00bish question. Is it necessary to define y... 1 3 | 1 | 3 | |
| | On Windows, I want to set the homePath in my indexes.conf file for a new index I created, which is located on my E:\ ... 0 1 | 0 | 1 | |
| | I have a WMI Perf counter query that always returns zero in Splunk as the values are always < 1 second. It looks like... 0 1 | 0 | 1 | |
| | I am trying to analyse a squid access log for top 10 reports (top sources, top destinations, etc.) I imported the lo... 1 5 | 1 | 5 | |
| | In this answer I can see there is ways to get the status of the tailing processor on a box. Only problem is it looks ... 0 2 | 0 | 2 | |
| | I turned off the syslog server running alongside Splunk and configured Splunk to listen on 514. It indexed the forwar... 1 3 | 1 | 3 | |
| | I am getting runtime error R6034 - "Am application has made an attempt to load the C runtime library incorrectly. I ... 0 1 | 0 | 1 | |
| | Hi There.. What is the best way to accomplish the following: I have several users who are on XP notebooks who need to... 1 1 | 1 | 1 | |
| | I have version 4.1 and have it set up to recieve syslog data directly from various servers but I only want to hold th... 1 1 | 1 | 1 | |
| | Hi there.Lets see if someone can help me with this. We have this requirement: We have several saved searches and rep... 2 5 | 2 | 5 | |
| | FORMAT = <string> * The special identifier $0 represents what was in the DEST_KEY before this regex was performed. ... 0 6 | 0 | 6 | |
| | This would be a very trivial question, but what are the circumstances when splunk re-indexes new data? Replacing an e... 0 5 | 0 | 5 | |
| | Hello , We have splunk 3.4.6 installed on one of our servers locally, on that server it was configured so that it ge... 0 1 | 0 | 1 | |
| | According to the wiki the best practice for syslog is having another program write the files to disk then have Splunk... 1 1 | 1 | 1 | |
| | Hi, I have used props.conf and transforms.conf to configure two different sourcetypes coming to Splunk from udp:514. ... 0 3 | 0 | 3 | |
