How to send data 514 port to splunk. I have configured TCP udp 514 port and also install cisco app on splunk. I need to send data from cisco to port 514 to splunk. ... View more

Hello team, From my understanding Add on is used for collecting information on which we install add on . App is used for visualization of data. For Unix add on and app :- we need install add on UF for which we need data. We need to install add on or app on indexer ( if we need data or not ? ) . We need visualization of data on Search head , then we need to install app on Search head. Somewhere written to install only add on only for all , any reason for same. For Mysql add on and app :- on HF we need to install add on and Search head we need to app. But we configure add on on HF and also on Search head , can not understand . Some where written mysql add on install on indexer and search head. any reason for same. ... View more

Hello , we have indexer clustering setup. We need to implement Splunk Add-on for Unix and Linux to monitors hosts. How we can do. in this case. ... View more

in this program :- Use tokens with input choices to capture input labels and values Last 7 Days -7d@d <input type="radio" token="period_tok"> <label>Select a time range</label> <choice value="-24h@h">Last 24 Hours</choice> <choice value="-7d@d">Last 7 Days</choice> <choice value="-30d@d">Last 30 Days</choice> <default>Last 7 Days</default> <change> <!-- use predefined input tokens to set --> <!-- tokens for the selected label and value --> <set token="date_label">$label$</set> <set token="earliest_tok">$value$</set> </change> </input> <panel> <title>Conditional Inputs</title> <chart> <!-- Display selected label in the title --> <title>Source Type by $date_label$</title> <search> <query>index = _internal | timechart count by sourcetype</query> <!-- use the value of earliest_tok --> <!-- to set the time range --> <earliest>$earliest_tok$</earliest> <latest>now</latest> </search> <option name="charting.axisY.scale">log</option> <option name="charting.axisTitleX.text">Time period</option> <option name="charting.axisTitleY.text">Events</option> </chart> </panel> my question as below :- 1) Last 7 Days -7d@d , what is use of it . 2) token="period_tok " what is use of it and it is for what function . ... View more

Search String | metadata type=sourcetypes index=_internal , what is its meaning here. ... View more

hello i want some help to understand Query used in chart panel and form , which one we are using add a line chart panel that uses the following search. index=_internal | timechart count But in form we use below Query :- a.Click Edit to open the dashboard editor. b.Select Add Input > Dropdown. 3.Configure the input. a.Select the input editing icon. b.Select Dynamic options. c.Add the following search to generate input labels and values. index=_internal | stats count by sourcetype | eval label=sourcetype." (".count.")" ... View more

Do props.conf and transforms.conf need to be created in $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local or can it be created in the deployment server GUI to push to indexers? ... View more