I removed mine, in lieu of this answer. ... View more

There are no issues in using WMI with Windows 2008 R2. Here is a full article on how to configure WMi support -- as well as permissions, rights, and other considerations: http://www.splunk.com/base/Documentation/4.1.7/admin/MonitorWMIdata One thing to keep in mind when using W2K8 R2 is that Windows Firewall is enabled by default. In order to allow WMI, you need to add a rule: netsh firewall set service RemoteAdmin enable ... View more

Interesting. I'm using a Mac, and stripping the nulls allows it to break the lines properly. At least with SEDCMD, you could substitute a newline or custom linebreak for the nulls. ... View more

I appended some nulls and 'exit' and some more nulls to your sample data. The SEDCMD seems to do the job. ... View more

Are you saying that when you specify "MID 2185496" as your search string, you only want to receive the events that have 2185496 as the MID? If so, you can accomplish this a couple of ways: 1: The best method would be to download the Cisco for Ironport E-mail add-on which will do the field extractions for you: http://splunkbase.splunk.com/apps/All/4.x/app:Cisco+IronPort+E-mail+Security+Add+On This will allow you to restrict your search to the specific fields within the events. For instance, you could search for messages of MID 2185496, like this: mid=2185496 | head 100 Adding that app will also allow you to install the Cisco Security Suite which will give you a nice set of pre-defined reports, dashboards, and saved searches: http://splunkbase.splunk.com/apps/All/4.x/App/app:Splunk+for+Cisco+Security 2: The other option is to do the field extraction yourself. The easiest way to do this is with the Interactive Field Extractor (IFX). Here's a link to the docs on IFX: http://www.splunk.com/base/Documentation/4.1.7/User/InteractiveFieldExtractionExample ... View more

Automatic Load Balancing with Splunk uses multiple A records mapped to a hostname. CNAMEs (aliases) won't produce the desired effect. IMO, use this method to configure a single hostname to LB your indexers, expire the A records for whichever IP you will retire, then migrate, then add an A record for the new indexer to add its IP to the LB pool. ... View more

What is the count for your sourcetype vmware_syslog on the summary page? 0? Judging by your host=vmware-* search that returns results, your REGEX won't match any of your events. Unless you plan to use some value that will be extracted by the REGEX as a part of your sourcetype, then you should use sourcetype= in props.conf, instead of your stanza in transforms.conf. PROPS.CONF: [source:://...mystuff...] sourcetype=vmware_syslog P.S. It looks like host:: does not belong in your REGEX -- probably a mixup from the FORMAT clause where that syntax is often used. I would scrap the transforms.conf config and just use props.conf for this. ... View more

If outputs.conf is already configured for auto-load balancing, why not just use one of the supported load balancing methods? You can have Splunk alternate IP addresses for a FQDN by simply configuring multiple A records for the FQDN on the DNS server. You can use autoLBFrequency to determine how often Splunk will rotate servers. Here's a verbose description of what your forwarder can do and how to configure it: http://www.splunk.com/base/Documentation/4.1.7/Admin/Setuploadbalancing Your method seems difficult to support and maintain in the long run. Generally speaking, when an application opens a socket using a hostname, a resolver will attempt various methods to translate the name into an IP address. The resolver is not part of the application, but a part of the IP stack and/or OS. If resolution was provided by a DNS server, there will be an associated TTL for the DNS entry. The TTL specifies that any resolver needs to cache the DNS entry for a specified maximum period of time. This doesn't just affect the client asking for the resolution -- it is also cached by the DNS server answering the question. Unless you use a single DNS server that is also authoritative for the zone, there is no reliable method to predict when a client will actually receive an updated DNS entry, since any intermediary DNS servers will also need to expire their cache. ... View more

A license issue wouldn't prevent the data from indexing. You can search the internal index to see if there are isues with those hosts: index=_internal sourcetype=splunkd ... View more

I can't reproduce the issue. I am using the following builds of Splunk: Splunk version 4.1.4 build 82143 Splunk version 4.1.6 build 89596 I tried with a 111-character search, as well as your sample with the *'s replaced by text. Are you running Firefox, or another browser? I'm using Firefox 3.6.4 ... View more

Why not just install using the tarball? ... View more

This method will not account for blank values or a missing field. See my answer to account for these. ... View more

Note: This will only affect new data being indexed. Restart Splunk after making the change. ... View more

You can configure character set encoding. Here is the manual page that describes how: http://www.splunk.com/base/Documentation/4.1.7/Admin/Configurecharactersetencoding ... View more

From what I can gather, you would be best off adding an entry to props.conf to allow Splunk to recognize each entry as a single event. You could do that like this: $SPLUNK_HOME/etc/system/local/PROPS.CONF: [mysourcetype] SHOULD_LINEMERGE = true MUST_BREAK_AFTER =^next$ This won't affect existing data, but it will allow Splunk to recognize each edit clause as a single entry for new data. ... View more

How do you determine a duplicate entry? By the EventIdentifier? Host? Use dedup to remove the duplicate values: ... | dedup EventIdentifier | timechart ... ... View more

The Splunk internal data does not count towards your license. ... View more