Additionally, here is the basic documentation which will get you started in understanding index-based separation: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setupmultipleindexes And here is documentation regarding routing which might be your approach if you need to have a HF direct different events to different physical indexers due to policy constraints: http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad ... View more

I am on my phone at the moment but the last time I downloaded from the splunk web dowload portal less than 15 days ago, the wget link was still there in a box at the upper right-hand region of the page once I got to the final download page. Under a heading something like "Got wget?" ... View more

According to the current documentation at least, the above is not the way it is supposed to work. From: http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards When determining the set of files or directories to monitor, Splunk Enterprise splits elements of a monitoring stanza into segments - defined as text between directory separator characters ("/" or "\") in the stanza definition. If you specify a monitor stanza that contains segments with both wildcards and regex metacharacters (such as (, ), [, ], and |), those characters behave differently depending on where the wild card is in the stanza. ... If a monitoring stanza contains a segment with regex metacharacters before a segment with wildcards, Splunk Enterprise treats the metacharacters literally, as if you wanted to monitor files or directories with those characters in the files' or directories' names. ... If the regex metacharacters occur within or after a segment that contains a wildcard, Splunk Enterprise treats the metacharacters as a regex and matches files to monitor accordingly. ... View more

Hello, The X-Forwarded-For header is not standard content for the access combined sourcetype. Since this header can contain a variable number of IP addresses, separated by commas you will need an extraction regex which expects a field with multiple IP addresses and extracts clientip as the first, this could be problematic due to the spaces which might be present in that field so you would need a fairly advanced regex to work reliably and not miss the other extractions for the event. I've looked around in answers and it seems like perhaps nobody has come up with a clean way to do what you are after. The built in extractions for apache logs depend heavily on extracting fields delimited by spaces, so an unquoted multivalued field containing spaces is going to be a problem. You could quote it in the log format string and make the extraction of this header easier, but at this point, you still have a list of an unpredictable number of IPs where the first is expected to be the actual client. I will keep looking for options as I find some time, but you may want to consider a different path. We have our load balancer/CDN add a custom X header containing the the client's true IP and we use the contents of this field as the clientip field in our log format string and this works pretty well. ... View more

Try using distinct count like this: "login *" sourcetype="*prod_logs" | rex field=_raw "login (?<email>.*)" | eval month_day=strftime(_time,"%2y/%2m/%2d") | chart dc(email) by month_day ... View more

Was the difference in the above to extraction expressions "\w" vs "\w+" intended? I have seen similar questions and note that it should work the same on indexed fields as well as extracted or _raw data. ... View more

Sorry it did not work out. If you do not find an answer using the "automatic" CSV index time extractions, you might consider using a different approach, namely a search-time extraction using KV_MODE=none, and the DELIMS = "," and FIELDS= "field1, field2, field3..." with a REPORT-class extraction as described here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles and in this old-ish example question: http://answers.splunk.com/answers/3006/best-way-to-have-the-splunk-indexers-handle-a-csv-log-file.html ... View more

I have not experimented with PREAMBLE_REGEX so I am not sure it will work. Have you tried something like: INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER = 1 PREAMBLE_REGEX = ^INTEGER Failing this you could try a null-queue transform: In props.conf: [your source or sourcetype spec] TRANSFORMS-null = discardit and in transforms.conf: [discardit] REGEX=^INTEGER DEST_KEY = queue FORMAT = nullQueue ... View more

As a starting point, I would suggest that you create/edit an inputs.conf on your universal forwarder under SPLUNKHOME/etc/system/local/ . The conf files are put into effect according to precedence rules you can learn about here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Wheretofindtheconfigurationfiles The other option you are talking about is pushing out configs via deployment apps from a deployment server to deployment clients. You can learn about this optional feature here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver ... View more

It looks like you are confusing forwarder management/deployment server functionality with an indication of forwarding activity. Forwarder management is optional and somewhat more advanced functionality to set up. Have you configured any actual inputs such as file or directory monitors on your forwarder? If not, you will likely not see anything in non-internal indexes since you have not set any inputs up. Let's go back to trsvela's search. If you search your internal index as suggested using your forwarder's hostname or perhaps its IP you might find that it is connected and sending splunk internal logs which get indexed in internal "_*" indexes. Id does look like there might be a problem though, did you perhaps configure some kind of output on your indexer which points to itself? ... View more

What have you read and/or tried? If you are completely new to the idea and need a starting point, the link below should help get you started with dynamic drilldown which is the way I have approached this requirement in the past. If you come up with specific questions or need guidance on a particular part of it then try posting something specific in a new question. http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/Dynamicdrilldownindashboardsandforms ... View more

I think Original Address data is actually present in the input before splunk gets it. This is a common thing for syslog implentations to do. Can you elaborate on why you think that splunk is appending this to your events/results? ... View more

Here is a search I was playing with which might get you closer to what you appear to be looking for, without the transaction overhead and possible confusion. GET clientip=* | stats dc(useragent) AS num_agents, values(useragent) by clientip | sort -num_agents ... View more

I have never heard of any major unresolved issues pertaining to OS patches on supported platforms. I have always referred to the System Requirements and deprecated support pages as a guideline but have not heard of any concerns. I would always make sure my configs and indexes were backed up regularly and especially before patching though. http://docs.splunk.com/Documentation/Splunk/6.2.1/Installation/SystemRequirements http://docs.splunk.com/Documentation/Splunk/6.2.1/ReleaseNotes/DeprecatedFeatures ... View more

Is this a splunk related question? If so, you will probably need to be more specific and concise since your wording seems general and does not seem to clearly ask something specific to splunk. ... View more

Sorry I missed your comment, but if the files are external to the sandbox instance, the standard way of getting them monitored and indexed involves installing a universal forwarder on the machine where the logs are generated, or at least a machine that has access to them. ... View more

This feature is called drilldown and for most visualizations you can turn it of by editing and selecting No for drilldown on the General settings tab. ... View more

Via splunk web on the deployment server. Go to settings->forwarder management, select the clients and type in part of the hostname in the filter text box. If it is phoning home it should show up there with app count and time since last phone-home. ... View more

The same configuration steps should work without any additional changes to the sandbox. Of course you might want do specify a different default host in your inputs.conf so that you can tell the hosts apart. Don't forget to install the credentials app on the additional forwarder. If you found my answer/comments helpful please accept the answer and/or give points. Thanks, I am glad you were able to get it working. ... View more

This is something missing/misconfigured on your sandbox. Did you install any additional apps to your sandbox? This sounds like a topic for a new question 😉 ... View more