Thanks! I just installed it and it works in my Windows Splunk server instance. ... View more

How about a GUI Installer, like the Windows Splunk UniversalForwarder has? That was an easy install. I haven't used Linux in about 2 years, and all this is vaguely familiar. If I mess up the Oracle Linux server this Splunk forwarder needs to be installed on, the Oracle DBA will be annoyed (to put it mildly) with me. ... View more

You are correct. Thanks! Using [perfmon://CPU Load] counters = % Processor Time;% User Time instances = _Total interval = 10 object = Processor index = wmi ... View more

Adding [default] evt_resolve_ad_obj = 0 to inputs.conf (on our Universal Forwarders) fixed the problem here when our Windows AD server changed. Thanks! ... View more

I am forwarding the .csv files from a different host using a Splunk Forwarder, if that makes a difference. [monitor://C:\MyLogs] crcSalt = <SOURCE> index = ctrlup sourcetype = ctrlup disabled = false ... View more

Table: Sessions Stress Level,ID,Session Name,User,Citrix Receiver Version,State,Connect Time,Disconnect Time,Idle Time,Logon Time,Processes,ICA Latency - Last Recorded,Client IP,Client Name,Computer,Domain DNS,Initial Program,CPU,Page Faults /sec,I/O Read Operations/sec,I/O Write Operations/sec,Memory (Private Bytes),Memory (Working Set),View Client Connection Server URL,View Client Domain,View Client Protocol,View Client Type,View Client Tunnel,User Logon Server,Group Policy Load Time,Profile Load Time,Logon Duration - Other,Desktop Load Time,Logon Duration "4.00","0","Services","","","Disconnected","","","","","61","0","0.0.0.0","","XXXX-AAAA","YYYY.com","","0.125","119.235","56.11817","0","1.040945E+09","1.223873E+09","","","","","","","0","0","0","0","0" "3.00","119","BBBB","ZZZZ","11.3.0.41560","Active","9/1/2015 2:39:59 PM","","00:00:00","9/1/2015 2:40:47 PM","26","47","10.0.0.1","CCCC","XXXX-DDDD","YYYY.com","My Desktop","0.25","118.1605","1.851977","1.474779","6.997975E+08","9.383158E+08","","","","","","XXXX-EEE","6","31","6","1","44" ... View more

Top user (75%) is "unknown" for the past hour, using your query above. Many other specific users listed below that. If I drill down on "unknown", I can get the client_ip, and based on the timestamp, I can find out who they really are. But why is PAN logging "unknown"? ... View more

I'm a little concerned that the biggest bandwidth user for the various categories is always "unknown" and not some specific individual. Could someone else running the Palo Alto Networks app run the above query and let me know if this "unknown" user is a common phenomenon there too? If it isn't, I might have to speak to the PAN implementers here to see why it is logging "unknown". Thanks. ... View more

I think you'd need the application to be able to log to one of 2 separate log files, on demand. Then, set up an alert (based on indexed volume for the day) to switch logging (via an alert-triggered script) to the log file that is not being indexed by Splunk. At midnight daily, fire another alert that will switch logging back to the log file that is being indexed. Some Java app servers can switch log4j logging levels on demand (via API) without a need to stop/start the app. I do this for DEBUG-level logging to a logfile (6 of them) that is not being indexed, that rolls over every hour. So I have the last 6 hours of logs, if I ever need to load any of them manually into Splunk for on-demand analysis of what just happened, without exhausting my daily indexing limit. Now, I'm tempted to write/automate the script that will do the switch... ... View more

I'd just like to add a note that a reason why my 1-minute real-time window was not producing results when I went from indexing 1.5GB/day to 36GB/day was because the forwarders sending events to my indexers were, by default, configured to throttle after 256KB/second. I changed maxKBps in limits.conf to zero in the forwarders, and the 1-minute real-time window displays updating counts now, without the need for clustering. ... View more

Yes, this seems to make sense now. I had radial gauges in my real-time dashboards that showed the count of incoming events in a 1-minute window. It stopped working (always reporting zero) after I turned on DEBUG logging level on some application servers which increased incoming events from 1.5GB/day to about 36GB/day. I might have to look at clustering Splunk to process things faster if I want the 1-min real-time reporting? ... View more