| | Would someone confirm the following observations regarding data input configuration via inputs.conf? when using wild... 0 3 | 0 | 3 | |
| | Hi, I have syslog_ng server (sles 10). Everything is logged in this way: /var/log/HOSTS/xx-yy/hostname or ip/log fi... 0 2 | 0 | 2 | |
| | I just installed Splunk 4.1 (configured to run on system accounts) and the first thing i did was add an input monitor... 1 1 | 1 | 1 | |
| | I need to figure out what LDAP values I should be using to make auth work. 1 3 | 1 | 3 | |
| | Does anyone know if alwaysOpenFile still works in inputs.conf as of Splunk 4.1. It still shows up in the 4.1 docs, b... 1 6 | 1 | 6 | |
| | I have a file with ~6M events that gets FTP'd to Splunk on a daily basis. Unfortunately I don't have control of the ... 1 1 | 1 | 1 | |
| | What is the mechanism for federating credentials between splunk servers when doing a distributed search? 1 2 | 1 | 2 | |
| | I'd like to convert a busy server with a bunch of users from default auth to LDAP. How can I do so without losing any... 1 3 | 1 | 3 | |
| | I am using Splunk to collect data from the security logs on my network. How long does Splunk store the data that it c... 0 2 | 0 | 2 | |
| | I have an instance that I've set up to only run summary searches. Essentially, its a search head but no users connec... 0 1 | 0 | 1 | |
| | For example, does Splunk ignore server.conf, distsearch.conf, or any other conf files if they're located in an apps d... 2 2 | 2 | 2 | |
| | I just upgraded my install to 4.1 and LDAP auth is no longer working. The failsafe user is all I can use. Previousl... 5 10 | 5 | 10 | |
| | After upgrading to 4.1 no charts display any timestamps on the y axis if the displayed time range exceeds 24 hours. T... 0 2 | 0 | 2 | |
| | Under Linux Splunk 4.1, I want to install the PDF Report Server and have downloaded the app file from Splunkbase. Whe... 3 2 | 3 | 2 | |
| | In inputs.conf the default host name is set to the fqdn, test-server.foobar.com. But when I search for that host, it ... 2 5 | 2 | 5 | |
| | Hi, I just created a new app and wanted to point my network inputs to another index, managed by my app. So, I modif... 1 3 | 1 | 3 | |
| | On a Solaris machine, I modified $SLUNK_HOME/etc/system/local/web.conf to use httpport = 80 The below error was then ... 4 5 | 4 | 5 | |
| | Is there a splunk command or REST endpoint to see the tailing status of monitored files? 4 2 | 4 | 2 | |
| | Search is index="_internal" source="*metrics.log" group="queue" | timechart perc90(current_size) by name Results are... 2 3 | 2 | 3 | |
| | I'm trying to index a file on a mapped network drive, but I keep getting seeing 'Access is denied' in splunkd.log. I... 4 1 | 4 | 1 | |
| | I just upgraded to version 4.1 and I'm seeing this message in the UI. My minimum free disk space is 1GB and I haven'... 2 1 | 2 | 1 | |
| | On my old setup I had all syslogs going to syslog on the Splunk server, but now I'm doing a fresh setup with Ubuntu 9... 1 4 | 1 | 4 | |
| | Splunk is running behind a webserver proxy. Splunk has the following config in web.conf: root_endpoint = /splunk T... 1 1 | 1 | 1 | |
| | I have a bunch of Lightweight Forwarders (LWF) forwarding to my central indexer. What happens to my events when the... 3 4 | 3 | 4 | |
| | I've just upgraded to 4.1 and now I'm getting an error when I search saying: The lookup table 'sid_lookup' does not ... 3 7 | 3 | 7 | |
