Splunk Administration

Category Activity

Backup and restore of Splunk?? Hi, Been trying to backup and restore of Splunk indexer and the steps that I took to backup our splunk server is: - ... by apro Path Finder in Monitoring Splunk 05-21-2010 1 2	1	2
Will Splunk automatically create an index listed in inputs.conf? If our app's inputs.conf uses an index other than "main" (e.g. a custom index for our app) does our app's setup UI (o... by Justin_Grant Contributor in Getting Data In 05-21-2010 1 5	1	5
Controlling forwarder TCP connections to indexer Does a forwarder keep using the initial TCP connection to the indexing server, or does it close the connection after ... by Jaci Splunk Employee in Getting Data In 05-21-2010 2 1	2	1
Web Logs Analysis ( apache ) Hi there. I'm new to splunk. Having a bit of trouble getting my head around it ( I know SQL well ) . I want to get... by return2health Engager in Getting Data In 05-21-2010 1 2	1	2
Inputs are all enabled but Search dashboard is showing 0 sources and 0 sourcetypes I am perplexed with what I'm experiencing right now. I have all the file inputs enabled for monitor but I'm not seei... by Nicholas_Key Splunk Employee in Getting Data In 05-21-2010 1 2	1	2
Rolled log file not being indexed I monitor a log file (access_log) that gets rolled every night at 1 am using a copy command "cp /dev/null access_toda... by Jaci Splunk Employee in Getting Data In 05-20-2010 1 3	1	3
Deployment Server with multiple repository locations using repositoryLocation= Trying to configure a deployment server to support multiple organizations. I have created a directory structure withi... by JHill Explorer in Deployment Architecture 05-20-2010 0 1	0	1
How do I ensure there is no event overlap in a scripted input? I am creating an app for Splunk 4.1 that has a scripted input that retrieves data from a database. At first run, it w... by jwestberg Splunk Employee in Getting Data In 05-20-2010 2 5	2	5
Migrate Splunk install from Win2003 32b to a new Win2008R2 64b server I need to move my Splunk install from one server to another... What's is the procedure to backup the configuration/in... by juank Engager in Installation 05-20-2010 1 3	1	3
How can I forward the internal Splunk logs of a Splunk deployment to another Splunk Let's say I have a distributed Splunk environment, n indexers, one search head and a forwarder load balancing input d... by Ledio_Ago Splunk Employee in Deployment Architecture 05-20-2010 3 2	3	2
WMI on windows 2000 Hi, I am collecting event logs thru WMI for Windows 2000 and 2003 servers, for 2003 everything seem ok but for 2000 ... by phoenixsecure Engager in Getting Data In 05-20-2010 2 2	2	2
How do keep splunk from removing syslog priority fields? How do keep splunk from removing syslog priority fields? They are removed once indexed into splunk. by Chris_R_ Splunk Employee in Getting Data In 05-19-2010 0 3	0	3
Lookup table does not exist error on update to 4.1 Since I updated our server to 4.1.2 I'm seeing the following error with most searches. The lookup table 'sid_look... by Yancy Path Finder in Getting Data In 05-19-2010 2 2	2	2
blacklist in batch stanza Can I use blacklist in a batch stanza? I couldn't find anything in the documentation saying otherwise. Thanks, by carmackd Communicator in Getting Data In 05-19-2010 2 2	2	2
How do you exclude dead machines off the Lost Forwarders search. I use the recommended search below to find lost forwarders after a 24hr period. http://www.splunk.com/wiki/Depl... by djfisher Explorer in Getting Data In 05-19-2010 1 5	1	5
static text above the appHeaderWrapper IF one wanted to add static highlighted text to the top of every page in their app... how would they go about doing t... by hiddenkirby Contributor in Security 05-19-2010 1 7	1	7
Too many open files on forwarders I'm starting to get a lot of these errors on my forwarders. Any suggestions? Pushing /etc/security/limits.conf does... by oreoshake Communicator in Getting Data In 05-19-2010 0 2	0	2
source files associated with a host How can I easily search through Splunk to figure out which sources are associated with a specific host? I know I c... by seanlon11 Path Finder in Getting Data In 05-19-2010 1 2	1	2
Splunk LF is utilizing a lot of CPU and Memory Hi all, One of the servers we installed Splunk LF on is having high CPU and Memory Utilization as a result of Splun... by balbano Contributor in Deployment Architecture 05-19-2010 1 6	1	6
Yet Another Problem Sending Events to the nullQueue We are using "heavy" forwarders, but I have the following config on both the forwarder and the indexer but the events... by oreoshake Communicator in Getting Data In 05-18-2010 1 4	1	4
stopping all listening ports? reposting for a user over on the forums: I bounced my indexer and now my forwarders are unable to connect. I just u... by piebob Splunk Employee in Getting Data In 05-18-2010 1 2	1	2
Can you disable an app with an app? Using Splunk server & clients running 4.1.2. When I installed Splunk on our many clients I enabled the SplunkLightFo... by mkinner Explorer in Deployment Architecture 05-18-2010 1 4	1	4
How to route to separate indexes based on host:: when forwarding to a indexer from SplunkLightForwarders I use several SplunkLightFirwarders on Suslog-ng servers to have a "buffer" to relatively large amounts of syslog tha... by ostmovid New Member in Deployment Architecture 05-18-2010 0 9	0	9
Managing Splunk LF with Deployment Server Hey guys, I managed to setup deployment server / client test model with our 2 central indexers and a test sample of... by balbano Contributor in Deployment Architecture 05-17-2010 0 1	0	1
Is it possibly to log a user in to Splunk automatically without setting enable_insecure_login to true and sending the user/password as query params? It used to be possible to log a user in to Splunk by sending the username and password in the body of a POST request ... by active Engager in Security 05-17-2010 2 2	2	2