Splunk Administration

Category Activity

Can I replicate a subset of the data to a non-Splunk destination? I need to do the following on my forwarder: Forward all data received and gathered by the forwarder to Splunk indexe... by Alan_Bradley Path Finder in Getting Data In 02-23-2010 1 1	1	1
retrying a scripted input after a failure [I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too] I have a... by Justin_Grant Contributor in Getting Data In 02-22-2010 1 2	1	2
Is it possible to tell LINE_BREAKER to stop eating my angle bracket? The use of LINE_BREAKER is a bit cryptic to me... ok, a lot. But I think I've managed to figure out how to break my ... by hulahoop Splunk Employee in Getting Data In 02-10-2010 0 6	0	6
How to direct certain sourcetypes into a non-default index When I've created a new index. how can I direct certain sourcetypes to be indexed in that new index, rather than into... by Alan_Bradley Path Finder in Security 02-10-2010 0 1	0	1
How do I group lines into a single event at index-time? What I'm trying to do: at index time, create a multiline event based on a unique ID. In the data sample below, I nee... by hulahoop Splunk Employee in Getting Data In 02-08-2010 2 6	2	6
What are the default sourcetypes and how are they determined? Sometimes Splunk sets the sourcetype on an incoming file as breakable_text or too_small. What determines these sourc... by Yancy Path Finder in Getting Data In 01-29-2010 1 1	1	1
monitoring hundreds of metrics and/or configuration items: how to do efficiently? I'm trying to use Splunk to monitor both runtime metrics and configuration state of a server application like JBoss o... by Justin_Grant Contributor in Getting Data In 01-27-2010 2 4	2	4
Remove annoying restart messaging I don't want to restart splunk right now, but the UI is giving my and my users an annoying message saying I need to r... by benstraw Splunk Employee in Deployment Architecture 01-27-2010 2 2	2	2
performance characteristics of dedup command I'm thinking about using the DEDUP commend to solve the following problem: I have an event with an ID field and I'd l... by Justin_Grant Contributor in Monitoring Splunk 01-22-2010 2 1	2	1
Can I monitor Windows Registry with Splunk? Are there ways in Splunk to monitor and index any activity on Windows Registry? by Ledio_Ago Splunk Employee in Getting Data In 01-20-2010 2 1	2	1
What sort of hardware should I use for my splunk install? I will have 100GB coming in per day, with an expectation of 20 concurrent users at any given time, with probably arou... by jrodman Splunk Employee in Monitoring Splunk 01-20-2010 2 1	2	1
What salts the password hash? What private key pairs are used to generate the hashed passwords in authentication.conf or the passwd file? by matt Splunk Employee in Security 01-15-2010 1 1	1	1
How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes? I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applicati... by jrodman Splunk Employee in Getting Data In 01-15-2010 2 1	2	1
How do I set a hostname? What do I need to do to set the correct hostname for an event? by matt Splunk Employee in Getting Data In 01-15-2010 2 3	2	3
My coldtofrozen script seems to hang splunk, what can I do? When my selected coldToFrozenScript runs, which can take 10 minutes, the splunk search interface stops working until ... by jrodman Splunk Employee in Getting Data In 01-15-2010 0 1	0	1
historical data on a new installation I just installed splunk and indexed a log file with data that is from earlier this year, The summary dashboard shows ... by benstraw Splunk Employee in Knowledge Management 01-14-2010 1 1	1	1
How do I allow users to edit a view? If our users navigate to Manager --> Views they can see all the views, but they do not have permissions to edit or ad... by matt Splunk Employee in Security 01-14-2010 1 1	1	1
I can't see data I know is indexed I have data indexed but the "all indexed data" dashboard module is empty. Searching for * over all time produces no r... by cfrln Explorer in Getting Data In 01-14-2010 2 2	2	2