We haven't migrated to 2k8 yet, so I haven't had the pleasure of indexing 2k8 logs, but looking at group policy documentation for 2k8 R2 the following sticks out: Machine, wdi.admx, Diagnostics: Configure scenario execution level. Determines the execution level for Diagnostic Policy Service (DPS) scenarios.\n\n\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the DPS will detect problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. [...] The DPS can be configured with the Services snap-in to the Microsoft Management Console. What execution level do you have the Diagnostic Policy Service (DPS) set for? Could it be that it's configured for detection and troubleshooting, and causes it to log the extra data? [edit] FYI 2k8 r2 group policies: http://www.microsoft.com/downloads/details.aspx?FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb&displaylang=en ... View more

It is my understanding that even if the forwarder queue is blocked, the local indexing continues. ... View more

Hmm we don't have win 2k8 deployed yet, so I am not sure, but it just seems like there should be GPO to customize the logs. Haven't been able to find info on the google yet... ... View more

If you are using a forwarder (with local indexing or without), if the link to the receiving server goes down it will resume forwarding where it left off once the link comes back up. I do not know if Splunk accounts for bad bits due to solar storms though... ... View more

http://technet.microsoft.com/en-us/library/cc739424(WS.10).aspx (Add the Log on as a service right to an account) ... View more

I edited my original answer to answer the question you posed in your comment.. ... View more

@Glenn, you could also add this as a custom workflow action and have a user kick this off with a click of a button. They would not need to remember the complicated syntax at that point. ... View more

Would the gentimes command be of help perhaps? This should be able to generate hourly slices (see the examples). http://www.splunk.com/base/Documentation/latest/SearchReference/Gentimes ... View more

I'm not 100% sure, but I think this should send you down the right path. Have a look at $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/view/ and possibly $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/viewmaster/ . Especially $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/view/dashboard.html looks promising. It references $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/layout/view.html which appears to be where you need to do some customization to change the template. Hope this works for ya. ... View more

Glenn, I think Simeon was right trying to use map and localize. I tried to do this as well, but as you found out once a search (saved or otherwise) is passed to map it doesn't spit out any results. This might actually be a defect in the product, I'll log a case about it. Here is however how you can work around it. It's not as pretty as map, but it works. First the search: * [search index=foo sourcetype="WindowsUpdateLog" Synchronizing | eval search="index=\"" + index + "\" host=\"" + host + "\" sourcetype=\"" + sourcetype + "\"" | eval earliest=min(_time-30) | eval latest=max(_time+30) | fields + search earliest latest | format "" "(" "" ") OR" "" "_cd=0"] easier to read: * [search index=foo sourcetype="WindowsUpdateLog" Synchronizing | eval search="index=\"" + index + "\" host=\"" + host + "\" sourcetype=\"" + sourcetype + "\"" | eval earliest=min(_time-30) | eval latest=max(_time+30) | fields + search earliest latest | format "" "(" "" ") OR" "" "_cd=0"] This search will return all events within 30 seconds of the events you are searching for. I am modifying the format command to spit out search ranges that we are passing to the outer wildcard search. If I don't try to modify the output of the format command I get the same Missing LHS for AND search error you were receiving, and if I just strip the outer parenthesis a trailing OR is added. I couldn't find a different way around the trailing OR so I decided to just give it a bogus event index id value (_cd=0). If there is a better way around it I'd appreciate if someone could leave me a comment. Here is some sample output of the subsearch: ( earliest="1278605705.287" latest="1278605765.287" index="foo" host="host1" sourcetype="WindowsUpdateLog" ) OR ( earliest="1278605704.974" latest="1278605764.974" index="foo" host="host1" sourcetype="WindowsUpdateLog" ) OR ( earliest="1278605173.017" latest="1278605233.017" index="foo" host="host2" sourcetype="WindowsUpdateLog" ) OR ( earliest="1278605171.423" latest="1278605231.423" index="foo" host="host2" sourcetype="WindowsUpdateLog" ) OR ( earliest="1278602104.633" latest="1278602164.633" index="foo" host="host1" sourcetype="WindowsUpdateLog" ) OR ( earliest="1278602104.242" latest="1278602164.242" index="foo" host="host1" sourcetype="WindowsUpdateLog" ) OR _cd=0 I hope this will work for you. ... View more

I am experiencing the same or at least very similar issue. I currently have case 44485 open, and apparently this is a known defect, SPL-30820. It appears to be an issue with SSL connections between deployment client and server. The scheduled target release as far as I know is 4.1.4. ... View more

Modify your regex as follows in the IFX (Interactive Field eXtraction) and it should work: .?(\|).?(\|).?(\|).?(\|).*?(\|)(?P<FIELDNAME>\w+)(\|) ... View more

I was wondering the same thing a couple of days back... ... View more

@Lowell I believe jrodman remarked in IRC that it might stand for special sauce or similar (my recollection is not clear on the exact phrase). Basically he wasn't sure what it meant 🙂 ... View more

There are three additional ways to reload a view as well as any navigation changes you have made in .../data/nav/ui/default.xml: 1 - Restart splunkwebservice by itself which will keep sessions authenticated, this should be transparent to your users ./splunk restartss 2 - You can make the changes via the manager (Manager > User Interface > Navigation Menus > nav name) by editing the XML there. This will instantly apply any changes you have made. 3 - Click on the splunk logo. See: http://answers.splunk.com/questions/3627/how-can-i-reload-a-view-im-editing-without-restarting-splunk/3629#3629 In regards to your subject line, how to organize saved searches, check out http://www.splunk.com/base/Documentation/4.0.11/Knowledge/Definenavigationforsavedsearchesandreports You can easily nest your searches manually or based on keywords in the search names. Here is an excerpt from a .../data/nav/ui/default.xml that I have in a simple app: <nav> <view name="flashtimeline" default='true' /> <collection label="Dashboards"> <view name="audio_access"/> <view source="unclassified" match="dashboard"/> <divider /> </collection> <collection label="Views"> <view source="unclassified" /> <divider /> </collection> <collection label="Searches &amp; Reports"> <collection label="Alert Searches" > <saved source="unclassified" match="alert:" /> </collection> <collection label="Audio Access" > <saved source="unclassified" match="audio" /> </collection> <collection label="Network"> <saved source="unclassified" match="network" /> </collection> <collection label="Reports"> <saved source="unclassified" match="report" /> </collection> <collection label="Security"> <saved source="unclassified" match="security" /> </collection> <collection label="Systems"> <saved source="unclassified" match="systems" /> </collection> <collection label="Unclassified"> <saved source="unclassified" /> </collection> <divider /> </collection> The match="" expression will assign searches to subfolders based on matches in the search's name. ... View more

@Lowell -- thanks! I had no idea. Then of course my deployment server doesn't work at this point due to some interesting scenario where SSL connections drop (SPL-30820) so that would explain why my local configs did not get overwritten 🙂 ... View more

@pjmenon -- would you mind posting your transforms.conf? ... View more

@pjmenon -- If the system picks up the files with the correct sourcetype at index time, I'm not quite sure what the problem is that you're having? ... View more