Hi fellow Splunkers! I'm curious to know what field extraction takes precedence if a field extraction is defined by the admin and shared with users and a user by himself created a second extraction slightly different in syntax for the same eventsource. What extraction-definition takes precedence? Thanks in advance! Kind Regards, pyro_wood ... View more

Hi fellow Splunkers! I have a working distributed environment, containing an indexer cluster with a separate master node and one search head. I have configured "forwarding search-head data to peers" already. This is my requirement: If I need to analyze new data, I want to upload a small data file via Splunk Web. Splunk Web is only available on the search head. At one step in the uploading process of a new file, I need to specify an index, which should store the data. BUT... somehow only the Splunk standard indexes are showing. Already configured custom-indexes won't. How am I able to upload small data files via search head and assign them to custom indexes? Thanks for the help! Kind regards, pyro_wood ... View more

Hi Splunkers! I'm about to set up a Distributed Management Console on my Master node of my indexer cluster. Unfortunately, after I did every step in the manual, the master shows a "duplicate instance name" as I try to apply the settings. And this is in fact true. The two indexers that are clustered have an instance (serverName) and a Machine name of their own. BUT the Instance (host) field has the name of the cluster master node. (it's similar to this question https://answers.splunk.com/answers/188595/splunk-62-cluster-message-duplicate-instance-name.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev) THE PROBLEM IS: I've checked the /splunk/etc/system/local/inputs.conf and server.conf on every indexer peer and they all have their own individual host or servername. The only thing I don't know about is the config I found in the /default directory which says [default] ... host = $decideOnStartup ... View more

Hi Splunkers! I have a problem when I'm trying to distribute new indexes made via Splunk Web on the master-node of my indexer cluster. I already know how to configure new indexes via indexes.conf on the master and how to distribute them via apply cluster-bundle. This works fine! Today, I tried to do the same thing via Splunk Web. The new index gets created and is displayed on the master, but when I'm trying to hit deploy, the following message shows: In handler 'clustermastercontrol': No new bundle will be applied. The master and peers already have this bundle with bundle id = .... How do I get the configured index onto the cluster peers? Thanks in advance! Kind regards, pyro_wood ... View more

Hello fellow splunkers! I'm about to set up an universal forwarder monitoring a specific path on a server. On this server I have some files in the following directory /this/is/an/example/. The actual files are named like in this example: AB0101262016 AB0201262016 ... AB1001262016 "AB01" is the name of the instance and will be constant everyday and the rest "01262016" is the date which will of course change everyday. I thought of an inputs.conf stanza that looks like the following: [monitor:///this/is/an/example/AB01*.txt] disabled = false index = example_application sourcetype = example_application_admin_log host = example_application_AB01 crcSalt = <SOURCE> ignoreOlderThan = 1d Is the use of the * wildcard legit? Is this stanza legit? Any Idea how to make this set up more efficient, because I need to set up 10 individual stanza's now for AB01 - AB10. (it's not that bad, only if you have an idea) Thanks in advance! Kind regards, pyro_wood ... View more

Hi Splunk-Community, As I found out through the Splunk docs, it is possible to run a deployer for a search head cluster on an existing master node of an indexer cluster. I found a lot of documents already describing how to set up the deployer on its own. Do I need to pay attention to anything different here? (if i want to deploy it on the master-node) How do I configure the master node to run deployer functions? Thanks in advance! Kind regards, pyro_wood ... View more

Hi, I have an environment consisting of two Indexers (clustered), one search head and one master node. I already read about distributing changes in the environment over the cluster-bundle function. Now I want to add lookup tables. Do I need to configure and upload the files on the master node? Can I distribute the lookup files/definitions via cluster-bundle? Thanks in advance! Kind regards, pyro_wood ... View more

Hi, I have one application at my company which logs only once a day. It hereby overwrites the file of the day before. How can I tell the universal forwarder to grab a specific file only once a day? I want to set an interval, there is no need for an exact point in time. Thank you! Best Regards, pyro_wood ... View more

Hi, I'm planning on deploying a Splunk infrastructure. I'm currently undecided whether I should build the infrastructure according to the following configurations. Multisite-Cluster hosted across two data centers with one ESX Server each Bare Metal Virtualization 1 Master Node residing on only one of the data centers 1 Search Head for each data center (hosted on ESX) 1 Indexer for each datacenter (hosted on ESX) OR 2 Indexers for each datacenter (hosted on ESX) With 1 indexer on each site, I planned to have a replication factor of 2 and a search factor of 2 and a site-rep-factor of 1. With 2 indexers on each site a replication factor of 4 and a search factor of 3 and a site-rep-factor of 2. Is it advisable to host 2 smaller indexers instead of one big indexer? Are there performance benefits or caveats? Regards, pyro_wood ... View more