Does the index jenkins_statistics exist on your system? ... View more

Check this doc, the Add controls to a dashboard part has an example on the Shared timepicker. 🙂 ... View more

Take a look at splunkd.log in var/log/splunk/ in your Splunk folder, look for any ERROR, WARN, CRIT. ... View more

Good spot! You still have to either remove the ?P because that's the start of a named capture group, and add FORMAT = yourfieldname::$1, or just add the fieldname after the ?P , like (?P<yourfieldname>yourregex) ... View more

Would say the same. Don't see a reason against it. ... View more

Just wondering - with SHOULD_LINEMERGE set to false, shouldn't it create single-line events and not merge at all, no matter if it finds a timestamp or not? ... View more

Yeah, the idiom "Pick up someones slack" 😉 ... View more

Just to mention it, there's no need to | dedup Country , cause after a stats by Country there won't be any duplicates for that field ever. To setup an alert, add a filter for your relevant countries (like | where Country="yourcountry" ), and then just have the alert fire when there is more than 0 results. 🙂 ... View more

You could also teach your company to not try to re-invent the calendar. Julius Ceasar and Pope Gregory XIII have done quite well doing so, maybe you could use that? Sorry, couldn't resist that urge, I have a customer that also tried to reinvent the wheel, eh, calendar, and it's really a PITA. 😉 ... View more

Just to add - the three digits refer (in this order) to the user a file belongs to, to the group a file belongs to, and to world (all users). Splunk complains because they're "world-writable", meaning anybody could change them, which is a potential security issue. Therefore, follow the advice above 🙂 ... View more

Please check if /opt/splunkforwarder/etc/auth/server.pem exists and can be read by the user Splunk runs at it. Have you modified it, or the password used for it? Does your outputs.conf contain a special sslCertPath settings for your indexers? If yes, check that file too. ... View more

On purpose or not, you ended up doing the best practice for that kind of use case. 😉 Syslog server writing to disk and Splunk monitoring those files is the recommended approach. ... View more

Can you please show an example event? ... View more

Hey, I just checked the docs you are likely refering too. They just use a common Splunk TCP input, which could be configured on every Splunk instance, although you usually don't do this kind of thing on an indexer, but on a UF or HF. Actually, the cleanest solution for this is usually have your source (in this case greylog) write it's data to a file, and then have Splunk read that file. If you ever restart that Splunk instance or it is for any other reason unavailable, you'll most likely loose the data that would be sent during that outage. With a file, Splunk will just catch up from where it stopped before a restart. Hope that helps! ... View more

Hey, just check this part of the docs for the right configuration: http://docs.splunk.com/Documentation/Splunk/7.1.0/Data/Configuretimestamprecognition Especially the Edit timestamp properties in props.conf part will tell you how to use TIME_FORMAT and TIME_PREFIX to get your log set up. ... View more

Start with tcpdump -nn -i yourinterfacehere host 1.2.3.4 where 1.2.3.4 is the IP address of the system you're trying to poll. Tty it with that, there is also plenty of docs on tcpdump available on the net. Good luck! ... View more

You need a props entry for the sourcetype WinEventLog:Security, that includes a FEW REPORT- settings in it. Make sure these come after those already shipped with Splunk, so that the Message field actually exists. You can check for that using splunk btool props list WinEventLog:Security , and see which REPORT- or EXTRACT- creates tue Message field. After that, create some transforms stanzas according to what you mentioned in props.conf, and simply put in the regex from above, SOURCE_KEY is Message, and you should be pretty good to go. There is a bunch of documentation on all of those topics available, so I think you should make it from here 😉 ... View more

I never thought of that as a possible use case... Will have to remember it 😉 ... View more

You can put in default, which would make it valid for all index that do not have a different value configured in their own stanza. There is no maxWarmSpanSecs at all. They on roll when one of the above mentioned criterias is fulfilled. ... View more

If I'd guess on this, it seems like a better practice to deliver a datamodel but with acceleration disabled, because everybody's needs are different. Acceleration can place additional load on a system, and not everybody needs it, so it's better to ship it disabled, and have people enable it if needed. 😉 ... View more

Did some parts of the regex go missing? It looks like it. ... View more