Both approaches posted here by Dan and muebel will work. Choosing one depends on how many domains you want to alert on as well as how you wish to maintain the list of bad domains. If there are just a few domains, go ahead and tag the domains as per muebel's example and schedule a saved search for the tag and enable alerting: http://www.splunk.com/base/Documentation/4.1.3/AppManagement/Createanalert If you have a large number of domains, or the list of domains to alert on changes frequently, follow Dan's example. Create a csv with the list of domains and have your search do a lookup on it: http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources Finally, schedule your search and alert on it: http://www.splunk.com/base/Documentation/4.1.3/AppManagement/Createanalert The advantage of the csv approach is that you can have anybody update the domain filter csv without needing to have special knowledge about splunk. This will appease your PHBs and make your life easier 🙂 ... View more

hostname is defined in the $SPLUNKHOME/etc/system/local/inputs.conf. If you want to push out a standard inputs.conf to multiple splunk instances you have a few options: Use a deployment server, creating a new app with your inputs.conf to be shipped out. A little bit up front setup time, but easy to manage many hosts. http://www.splunk.com/base/Documentation/latest/Admin/Aboutdeploymentserver If you want to manually (or via script) do this, simply place the inputs.conf into $SPLUNKHOME/etc/apps/search/local. The inputs.conf at this location does not define the hostname, so you don't have to worry about overwriting it by accident or setting it yourself. Take a look at the configuration file reference in the documentation, this should make a lot more sense then. http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles ... View more

According to jrodman in #splunk on IRC (you might know him) one can reload all views in any given app by clicking the app's logo (the splunk> logo unless customized) in the top left of the page. Note that you will be returned to the default view of the app. Another way is to restart splunkweb only using ./splunk restartss to restart the splunkweb server. Please note that restartss may not play well with active searches, so be cautious using it on production systems. ... View more

Are you by any chance adding the fschange monitor on a forwarder? If so, this is broken (unless you want to pipe it into the _audit index, which may or may not be enough for you). Was in 4.1.2 and is in 4.1.3. http://www.splunk.com/base/Documentation/4.1.2/ReleaseNotes/Knownissues Support has been unable to provide me with an ETA for the fix. As a workaround I use a regular monitor stanza combined with a custom sourcetype to index full files of interest. You can still run diffs and whatnot on the files that way. And since you're on windows you can enable object level auditing via group or local policy and log what user made the change for accounting purposes. I use the following monitor to index changes to my splunk configs for example (inputs.conf): [monitor://C:\Program Files\Splunk\etc\...\*.conf] followTail = False sourcetype = splunk_config index = my_custom_index disabled = false and define the splunk_config sourcetype in props.conf as such: [splunk_config] BREAK_ONLY_BEFORE=goblygook MAX_EVENTS=200000 DATETIME_CONFIG = NONE CHECK_METHOD = modtime pulldown_type = true LEARN_MODEL = false this combination will index all files under splunk\etc ending in .conf. The BREAK_ONLY_BEFORE=gooblybook basically tells splunk not to break the event (in this case the conf file) until it encounters "gooblygook" which shouldn't be in any of your files. It would be better to use fschange but until it is fixed on forwarders this workaround should do. ... View more

Put an index parameter into each monitor stanza as such: [monitor:///var/log/blah] index = blah [monitor:///var/log/fu] index = helloworld If you do not define an index parameter the data will go into the default index. Check the manual on inputs here for more information: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Editinputs.conf ... View more