Splunk Administration

Category Activity

How can I forward the internal Splunk logs of a Splunk deployment to another Splunk Let's say I have a distributed Splunk environment, n indexers, one search head and a forwarder load balancing input d... by Ledio_Ago Splunk Employee in Deployment Architecture 05-20-2010 3 2	3	2
WMI on windows 2000 Hi, I am collecting event logs thru WMI for Windows 2000 and 2003 servers, for 2003 everything seem ok but for 2000 ... by phoenixsecure Engager in Getting Data In 05-20-2010 2 2	2	2
How do keep splunk from removing syslog priority fields? How do keep splunk from removing syslog priority fields? They are removed once indexed into splunk. by Chris_R_ Splunk Employee in Getting Data In 05-19-2010 0 3	0	3
Lookup table does not exist error on update to 4.1 Since I updated our server to 4.1.2 I'm seeing the following error with most searches. The lookup table 'sid_look... by Yancy Path Finder in Getting Data In 05-19-2010 2 2	2	2
blacklist in batch stanza Can I use blacklist in a batch stanza? I couldn't find anything in the documentation saying otherwise. Thanks, by carmackd Communicator in Getting Data In 05-19-2010 2 2	2	2
How do you exclude dead machines off the Lost Forwarders search. I use the recommended search below to find lost forwarders after a 24hr period. http://www.splunk.com/wiki/Depl... by djfisher Explorer in Getting Data In 05-19-2010 1 5	1	5
static text above the appHeaderWrapper IF one wanted to add static highlighted text to the top of every page in their app... how would they go about doing t... by hiddenkirby Contributor in Security 05-19-2010 1 7	1	7
Too many open files on forwarders I'm starting to get a lot of these errors on my forwarders. Any suggestions? Pushing /etc/security/limits.conf does... by oreoshake Communicator in Getting Data In 05-19-2010 0 2	0	2
source files associated with a host How can I easily search through Splunk to figure out which sources are associated with a specific host? I know I c... by seanlon11 Path Finder in Getting Data In 05-19-2010 1 2	1	2
Splunk LF is utilizing a lot of CPU and Memory Hi all, One of the servers we installed Splunk LF on is having high CPU and Memory Utilization as a result of Splun... by balbano Contributor in Deployment Architecture 05-19-2010 1 6	1	6
Yet Another Problem Sending Events to the nullQueue We are using "heavy" forwarders, but I have the following config on both the forwarder and the indexer but the events... by oreoshake Communicator in Getting Data In 05-18-2010 1 4	1	4
stopping all listening ports? reposting for a user over on the forums: I bounced my indexer and now my forwarders are unable to connect. I just u... by piebob Splunk Employee in Getting Data In 05-18-2010 1 2	1	2
Can you disable an app with an app? Using Splunk server & clients running 4.1.2. When I installed Splunk on our many clients I enabled the SplunkLightFo... by mkinner Explorer in Deployment Architecture 05-18-2010 1 4	1	4
How to route to separate indexes based on host:: when forwarding to a indexer from SplunkLightForwarders I use several SplunkLightFirwarders on Suslog-ng servers to have a "buffer" to relatively large amounts of syslog tha... by ostmovid New Member in Deployment Architecture 05-18-2010 0 9	0	9
Managing Splunk LF with Deployment Server Hey guys, I managed to setup deployment server / client test model with our 2 central indexers and a test sample of... by balbano Contributor in Deployment Architecture 05-17-2010 0 1	0	1
Is it possibly to log a user in to Splunk automatically without setting enable_insecure_login to true and sending the user/password as query params? It used to be possible to log a user in to Splunk by sending the username and password in the body of a POST request ... by active Engager in Security 05-17-2010 2 2	2	2
How to forward internal events through two forwarders? I am having trouble getting _internal and _audit to be forwarder properly when being passed through more than one for... by Lowell Super Champion in Getting Data In 05-17-2010 1 6	1	6
Collect data from different sources with different users... Hello I have a question about splunk capabilities. I installed splunk on a server (domain member) and I can get th... by petru Engager in Getting Data In 05-17-2010 1 1	1	1
Splunk installed under local username, but want to monitor AD Hi, We have installed Splunk under an eval using just a local username. We'd like to monitor AD, but can't work out ... by craigallen Engager in Getting Data In 05-17-2010 1 1	1	1
WMI source/sourcetype problem We are having a problem getting the Windows app to display wmi data. It seems that the wmi data we are getting is bei... by msallman Explorer in Getting Data In 05-14-2010 0 7	0	7
User and Admin manual Hi everybody, I try to download the user and admin manual in pdf format. Unfortunlly, it take me a long time and afte... by tbhuy New Member in Security 05-14-2010 0 2	0	2
What are the id_XX buckets that show up under "index activity" What are the id_XX buckets that show up under "index activity", They also show up in the bucket directories. What do ... by Chris_R_ Splunk Employee in Deployment Architecture 05-13-2010 0 4	0	4
Can I distribute my search across one 32-bit and one 64-bit Splunk instance simultaneously? If I have a Splunk indexer running on a 32-bit OS and another Splunk indexer running on a 64-bit OS, can I setup Splu... by maverick Splunk Employee in Deployment Architecture 05-13-2010 1 2	1	2
What are these WARN DateParserVerbose messages in splunkd.log? On Splunk 4.1, I see a bunch of these messages. What do they mean? Should I be concerned? 04-28-2010 13:48:32.27... by Dan Splunk Employee in Getting Data In 05-13-2010 2 3	2	3
form input suggestions (google suggest) So i've set up a form dashboard to filter a query displayed in a table. Is there any way to get a "google suggest" t... by hiddenkirby Contributor in Security 05-13-2010 1 4	1	4