So does this actually disable all local indexing on the search head, and forward all data to the indexers? ... View more

Try these settings, changing where appro. props.conf [my_sourcetype] LOOKUP-mylookup = terminations Termination_Cause transforms.conf [terminations] filename = my_lookup.csv ... View more

Exactly what I needed, thanks! ... View more

I would look at the logic embedded in the Unix application's treatment of 'ps'. You're going to want 'multikv', I think. ... View more

search that returns customer and call data | bin _time span=1d | stats count as calls by _time,customer Now you have the number of calls per customer per day The key thing is bin - this massages the times to the closest day Add the following for average calls / day per customer : | eventstats avg(calls) as avg_calls by customer or if you don't need so much detail : | stats avg(calls) as avg_calls by customer ... View more

This worked really well, although instead of using StaticContentSample I used the genericHeader module. Only reason being that genericHeader displayed everything with the correct CSS right off the bat, and there was less fuddling around with trying to put in CSS inline. Thank you for the help! ... View more

My best suggestion is to use summary indexing periodically. If you want it in realtime, you're going to need to optimize splunk as much as possible. I also recommend setting up index-time field extraction to help too. ... View more

1) You can use the REST API to create an index on the fly. See http://splunk-base.splunk.com/answers/96233/create-new-index-without-restarting-splunk-indexer. 2) The problem with a specific coldPath setting is that each index will have to have its own, and if they all inherit the same setting, they'll be writing to the same folder and will thereby generate bucket collisions. 3) Try a volume setting instead. By setting volume:cold, you can then reference a handy shorthand when you create the index. 4) Combine points 1 and 3, create a shell script to issue a curl command line REST call to create a new index, and automatically populate the coldPath setting including a volume:cold (and the name of the index as supplied on the command line) to give your developers the flexibility they need. ... View more

Correct - we have 11 indexers currently. 🙂 ... View more

I downvoted this post because not working at all ... View more

It overlooks the existing definition if the index is defined in system folder. If the indexes.conf is defined in the app folders, it depends on the precedence of the app[http://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles -> How app directory names affect precedence ]. I have tested myself, splunk works fine. It only creates a new folders with same index names. But i am not sure about the old data if it's searchable or not. there is a good explanation of it, slightly related to the question http://splunk-base.splunk.com/answers/50881/indexesconf-location ... View more

This worked really well, thank you! ... View more

This worked exactly as I needed, thank you! I now have beautiful 281 line events, ha! ... View more

Yes you can , File precedence is as follows: System local directory -- highest priority App local directories App default directories System default directory -- lowest priority http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Wheretofindtheconfigurationfiles ... View more

Yes, look at this example: http://docs.splunk.com/Documentation/Splunk/6.3.1511/Viz/Chartcontrols#Chart_overlay_example_.28dual_axis.29 ... View more

That's exactly what I was looking for now I can just leave the older boxes alone, and eventually move them over to using the deployment server without too much impact to service. It's good to know that you can make an app with nothing more than an outputs.conf file. ... View more

Weird. The last part of that got screwed up. Should read: Regarding the ifconfig error you were having, try this on the host with the forwarder installed. On some distros (debian), non-root accounts don't know the path to ifconfig. Switch to splunk user: sudo su - splunk which ifconfig Might return nothing. ifconfig Might return: -bash: ifconfig: command not found It's probably in sbin. /sbin/ifconfig If that is the case, maybe you could add something in the pushed nix app that lets it know about that path, or calls ifconfig directly. ... View more

There are two things that i would try restart the splunkd service if you haven't already. This should recognize the serverclass.conf file and enable the deployment server. The other thing I would try is to deploy / setup an empty app that does nothing. Also from the client perspective I think as long as you have the deploymentclient.conf deployed the client will say enabled. I hope this helps ... View more

This looks like it is working! I just have to add a ":00" behind the date hour and rename the fields and I should be GTG. Thank you! ... View more

This is exactly what I was looking for, thank you! ... View more

off the top of my head : | rex "From:.*?<sip[:+]+(?<FROM_FIELD>[\w.]+)" so thats : "From:" followed by any number of characters up to the 1st "<sip" Then 1 or more of : or + Then we capture as many word characters (A-Z a-z 0-9 _ ) or "." as we can and put it in the FROM_FIELD ... View more