Splunk Administration

Category Activity

What is the difference between a lightforwarder and a regular forwarder? Apart from the fact that a lightforwarder does not have a web UI, what are the main differences between the 2 apps? by Mick Splunk Employee in Getting Data In 03-09-2010 0 2	0	2
Data from forwarder arrives at the indexer but does not get indexed Hi I have set up a light weight forwarder that appears to be getting data to the indexer. But I can't search for an... by chris Motivator in Getting Data In 03-05-2010 2 2	2	2
What time format do I use when setting srchTimeWin (in authorize.conf)? I'm trying to configure a search Time Window for my Splunk roles. I've read the documentation but can't find instruc... by the_wolverine Champion in Installation 03-05-2010 1 1	1	1
ERROR SavedSplunker - No record for that user Seeing this error in splunkd.log on a splunk indexer when running a saved search. What does it mean? by Jaci Splunk Employee in Monitoring Splunk 03-01-2010 2 1	2	1
AD is only returning 1000 entries. How do I get around this? I'm trying to configure LDAP auth for Splunk. I'm running into an issue where AD is only giving me 1000 entries and ... by the_wolverine Champion in Security 02-27-2010 2 2	2	2
Estimating storage requirements on a windows server In the installation manual it shows how once you have indexed some data by using the "du -shc hot_v*/rawdata" command... by Scott Engager in Installation 02-23-2010 1 1	1	1
Can I replicate a subset of the data to a non-Splunk destination? I need to do the following on my forwarder: Forward all data received and gathered by the forwarder to Splunk indexe... by Alan_Bradley Path Finder in Getting Data In 02-23-2010 1 1	1	1
retrying a scripted input after a failure [I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too] I have a... by Justin_Grant Contributor in Getting Data In 02-22-2010 1 2	1	2
Is it possible to tell LINE_BREAKER to stop eating my angle bracket? The use of LINE_BREAKER is a bit cryptic to me... ok, a lot. But I think I've managed to figure out how to break my ... by hulahoop Splunk Employee in Getting Data In 02-10-2010 0 6	0	6
How to direct certain sourcetypes into a non-default index When I've created a new index. how can I direct certain sourcetypes to be indexed in that new index, rather than into... by Alan_Bradley Path Finder in Security 02-10-2010 0 1	0	1
How do I group lines into a single event at index-time? What I'm trying to do: at index time, create a multiline event based on a unique ID. In the data sample below, I nee... by hulahoop Splunk Employee in Getting Data In 02-08-2010 2 6	2	6
What are the default sourcetypes and how are they determined? Sometimes Splunk sets the sourcetype on an incoming file as breakable_text or too_small. What determines these sourc... by Yancy Path Finder in Getting Data In 01-29-2010 1 1	1	1
monitoring hundreds of metrics and/or configuration items: how to do efficiently? I'm trying to use Splunk to monitor both runtime metrics and configuration state of a server application like JBoss o... by Justin_Grant Contributor in Getting Data In 01-27-2010 2 4	2	4
Remove annoying restart messaging I don't want to restart splunk right now, but the UI is giving my and my users an annoying message saying I need to r... by benstraw Splunk Employee in Deployment Architecture 01-27-2010 2 2	2	2
performance characteristics of dedup command I'm thinking about using the DEDUP commend to solve the following problem: I have an event with an ID field and I'd l... by Justin_Grant Contributor in Monitoring Splunk 01-22-2010 2 1	2	1
Can I monitor Windows Registry with Splunk? Are there ways in Splunk to monitor and index any activity on Windows Registry? by Ledio_Ago Splunk Employee in Getting Data In 01-20-2010 2 1	2	1
What sort of hardware should I use for my splunk install? I will have 100GB coming in per day, with an expectation of 20 concurrent users at any given time, with probably arou... by jrodman Splunk Employee in Monitoring Splunk 01-20-2010 2 1	2	1
What salts the password hash? What private key pairs are used to generate the hashed passwords in authentication.conf or the passwd file? by matt Splunk Employee in Security 01-15-2010 1 1	1	1
How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes? I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applicati... by jrodman Splunk Employee in Getting Data In 01-15-2010 2 1	2	1
How do I set a hostname? What do I need to do to set the correct hostname for an event? by matt Splunk Employee in Getting Data In 01-15-2010 2 3	2	3
My coldtofrozen script seems to hang splunk, what can I do? When my selected coldToFrozenScript runs, which can take 10 minutes, the splunk search interface stops working until ... by jrodman Splunk Employee in Getting Data In 01-15-2010 0 1	0	1
historical data on a new installation I just installed splunk and indexed a log file with data that is from earlier this year, The summary dashboard shows ... by benstraw Splunk Employee in Knowledge Management 01-14-2010 1 1	1	1
How do I allow users to edit a view? If our users navigate to Manager --> Views they can see all the views, but they do not have permissions to edit or ad... by matt Splunk Employee in Security 01-14-2010 1 1	1	1
I can't see data I know is indexed I have data indexed but the "all indexed data" dashboard module is empty. Searching for * over all time produces no r... by cfrln Explorer in Getting Data In 01-14-2010 2 2	2	2