I configured universal forwarder to transfer raw data to Splunk indexer and 3rd-party syslog server by following configurations. #outputs.conf [tcpout] defaultGroup = default-autolb-group, sub-group [tcpout:default-autolb-group] server = splunk_server:9997 [tcpout:sub-group] server = syslog_server:514 sendCookedData = false And I found 3rd-party syslog server receiving following messages from UF continuously. Mar 6 14:20:55 ForwarderInfo build=196940 version=6.0.2 os=Linux arch=x86_64 hostname=splk guid=XX-XX-46F4-BF90-XXXXXXXX fwdType=uf ssl=false lastIndexer=172.XX.XX.XXX:9997 Mar 6 14:21:25 ForwarderInfo build=196940 version=6.0.2 os=Linux arch=x86_64 hostname=splk guid=XX-XX-46F4-BF90-XXXXXXXX fwdType=uf ssl=false lastIndexer=172.XX.XX.XXX:9997 I think these messages mean heatbeat from UF to syslog server. However, README of outputs.conf, outputs.conf.spec says heartbeatFrequency = <integer> * How often (in seconds) to send a heartbeat packet to the receiving server. * Heartbeats are only sent if sendCookedData=true. * Defaults to 30 seconds. Now I have a contradiction because I set "sendCookedData=false". What do that message mean ? And are there any way to stop sending that messages ? ... View more

Hi Splunkers, I want to know how does it take for splunk to index the data in subseconds? So I prepared the following configration file. props.conf [sampledata] DATETIME_CONFIG = CURRENT But in this time, Splunk add timestamps (in this case, system time) in seconds to each events. I know that we cannot use "TIME_FORMAT" option together with "DATETIME_CONFIG = CURRENT". And in default setting, index date (_indextime field) is also in second order. How can we recognize there fields (_indextime and _time fileds) as values in subsecond order to calculate index time ? Thank you for your help. I updated my question below. Splunk logs are recognized as subsecond timeformat events. I used these logs to calculate the index time. However, default "_indextime" fields don't have subsecond timeformat. Can I change this definition to change to subsecond order event. ... View more

Hi Splunkers, I cannot install UF to Windows Server 2008 by command line. C:\>dir 2013/10/09 19:19 40,817,152 splunkforwarder-6.0-182611-x64-release.msi C:\>msiexec.exe /i splunkforwarder-6.0-182611-x64-release.msi DEPLOYMENT_SERVER="my_deployment_server:8089" AGREETOLICENSE=Yes /quiet Why ? Thank you for your help. ... View more

Hi Splunkers, I want to know the index time lag in subsecond order by following command. index=main | eval index_lag = _indextime - _time | convert timeformat="%H:%M:%S.%3N" ctime(index_lag) But the values of "index_lag" are below. 00:00:00.000 00:00:01.000 These results may be wrong in subseconds. How to get correct figures ? Thank you. ... View more

Hi Splunkers, I know that Universal Forwarder monitoring windows eventlog has a check point file and fishbuckets. In re-transferring data to the Indexer, we have two cases. For example, it seems to be two cases. 1. Delete fishbuckets, not changing check points files. 2. Change check point files, not deleting fishbuckets. Case 1, in default setting, UF seems to transfer all local eventlog to Indexer. Case 2, we actually can set a record ID from which start to read. But I cannot understand these logic. Does UF read check point file and start transferring data irrelevant to fishbuckets ? Or does UF not transfer data in spite of changing the check point file because of fishbuckets ? Thak you for your help. ... View more

Hi Splunkers, Just my interest, not a serious question. Why is frozenTimePeriodInSecs about 6 years (188697600 secs =2184 days =5.9835 years), not just 6 years ? Thanks. ... View more

WMIポーリングで取得したWindowsイベントログをSEDCMD属性で置換したいのですが、 下記のprops.confを設定してもうまく置換されません。 何か対応方法ございますでしょうか。 ＜props.conf＞ [WMI:WinEventLog:Security] SEDCMD-win = s/ログオン/ログオンです/g ちなみに英語の場合には置換することが出来ました。 ... View more

Hi splunkers, Yesterday, I was monitoring the splunk_access.log and found the log messages that deployment clients poll to the deployment server, both platforms are Windows Server, Splunk V5. The messages in one poll are below. 172.XX.XX.XXX - - [29/Oct/2013:02:56:31.939 +0900] "POST /services/broker/phonehome/connection_172.XX.XX.XXX_8089_splk23_splk23_41EB9A91-5859-4029-A6FE-D7C46CDEB486 HTTP/1.0" 200 278 - - - 219ms 172.XX.XX.XXX - - [29/Oct/2013:02:56:31.721 +0900] "POST /services/broker/phonehome/connection_172.XX.XX.XXX_8089_splk23_splk23_41EB9A91-5859-4029-A6FE-D7C46CDEB486 HTTP/1.0" 200 995 - - - 219ms Now I have a question that what each messages which have different bytes are meaning for ? And I also found that sometimes 995 bytes data got lost, or not the normal interval. Is it a problem, or not ? Thank you for your help. ... View more

Hi Splunkers, I'm considering about the configuration of Deployment Server (and Client). How long does Deployment Client continues to poll to Deployment Server when we stop the deployment server or get some clients off the list in serverclass.conf ? Clients poll eternally ? or stop to poll in some time ? Can I change that time ? Thanks. ... View more