Also, when you ran btool, you said you didn't see a conflict but did you see your configuration as expected? ... View more

Which app that the input.conf resides in is really just a matter of organization, since Splunk puts them all together anyway. It won't matter if it resides in the search app. As for the data not being indexed, there are a few things to check, first would be to check make sure that the user Splunk is running under has permissions to read the file you're monitoring. Second is, it's possible that the data is being indexed but not being timestamped properly. If you run a search on index=*, using real-time/all time, you'll see the data being indexed, regardless of the date/time. ... View more

According to that file, it should definitely be going to the "test" index. If I understand correctly, the data is being indexed, it's just going to the default index (main) instead of "test"? Is that correct? If that's the case, there may be a conflicting configuration. You can find out what the active configuration is by utilizing the btool command. As you've seen now, there is more than one inputs.conf, that is the case with other config files as well. You can see the compilation of inputs.conf files from various apps, as well as system, by running this command: $SPLUNK_HOME/bin/splunk cmd btool inputs list --debug You can find additional info about the btool command here: Splunk btool ... View more

OK, since you added the inputs via the web interface, they will be stored within the context of the app that you were in when you configured them. To find out what that is, you can go into settings > data inputs > files & directories, find your input and look to the right to see what app the configuration is in. You will find that input.conf in $SPLUNK_HOME/etc/apps/ /local ... View more

Can you provide the inputs.conf file where your inputs are specified? ... View more

The props/transforms would go on the search head for field extractions but you wouldn't need that if going the key=value route. Can you modify your script to place the values in quotes? so, for instance, sqlUptime="156.1:8:45" ... View more

The props.conf example, that you're showing here, only includes what I would refer to as onboarding config (pre-index). That is linebreaking, date/time extraction, time format, etc. There are also search-time configurations that go into props.conf, such as EXTRACT, where you can specify a regex right in the props file. You can also reference configurations that reside in transforms.conf, such as with REPORT. My point with the original post is that just having a transforms.conf file doesn't do anything, you have to reference the configs that reside in it from props.conf. Example: --- props.conf --- [my_db] REPORT-db_extractions = my_db_extractions --- transforms.conf --- [my_db_extractions] DELIMS = "|" FIELDS ="EventID","AlertTime","UserName",. . ." Another thing to consider, if you have control over the powershell script, is to output the results of the powershell script in key=value pairs. Splunk will automatically extract key=value pairs. This is more dynamic, in the event that the number of fields changes in your output. No transforms.conf necessary. ... View more

It actually would go on both, on the indexer for capture of data from universal forwarders and on search heads for field extraction. ... View more

You'll need to reference these transforms in props.conf. Check out REPORT- in the props.conf doc for details. ... View more

One possibility is to use an inline rex or EXTRACT via props.conf. The inline rex(s) would look something like this: <your base search> | rex "\<filesize\>\s*(?<fsize>\d+)\s*\<\/filesize\>" | rex "\<transtime\>\s*(?<ttime>\d+)\s*\<\/transtime\>" | eval avgtime=fsize/ttime Out of curiosity, what sort of trouble are you having with xmlkv and spath? ... View more

As of Splunk 6, there is a simpler way to filter which Windows events are forwarded by Splunk. See whitelist and blacklist in the "Windows Event Log Monitor" section of the following doc: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf ... View more

A restart of an indexer will not cause changes made on the forwarders to take effect. If changes are made on the forwarder, then the forwarder instance needs to be restarted. Note that when using Splunk deployment server, you can put a directive in the configuration to have the forwarder automatically restart upon receiving a change. See restartSplunkd in the following doc: http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Serverclassconf ... View more

You may want to consider a scripted input to apply some additional logic to the collection. http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf ... View more

If you want fixed output, take a look at the table command: http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Table As for filling in values that are null, take a look at the fillnull command: http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Fillnull putting those together for a command such as: <your search> | table field1 field2 field3 UserID | fillnull value="0" UserID ... View more

It's essentially setting scope, as well as editing permissions to read/write. You can look under "settings -> searches and reports" and check sharing to edit what those settings are. For dashboards, there is no scope, just read/write, check under "settings -> user interface -> views". ... View more

Check permissions on all of the components (dashboards, saved searches, etc). This might be easier via the web interface but you can also lookup in <app_name>/metadata/local.meta ... View more

When using the Rex command, the regular expression must be in quotes. ... View more

Depending on your environment, you should be able to get the MAC/IP pairings from DHCP server logs. I say that it depends because you may not be using DHCP to statically assign IP addresses to servers. Another option would be to have Splunk forwarders on your servers, that utilize a scripted input (ifconfig for nix or ipconfig for Windows). ... View more

Whoops, sorry about that. Updated the answer. ... View more

What is the sourcetype that the symantec events are coming in as? If it's not "sep", try setting the sourcetype to sep in inputs.conf. ... View more

Yes, Splunk can run as the local system account. Are you having trouble with permissions or still in the planning stages? ... View more