Hello, If splunk suffers from anything its an overabundance of documentation.... everywhere. On each page of the release notes there is a "Changelog" section on the left side of the page and on that a subsection called "Distributed deployment, forwarder and deployment server issues" which should have what you're looking for. Here's what I could find: Release Notes for the current version: http://docs.splunk.com/Documentation/Splunk/6.3.3/ReleaseNotes/MeetSplunk Release notes for all version (except the current one): https://www.splunk.com/page/previous_releases/universalforwarder Then select your forwarder OS type. ... View more

If you're looking for just regex, depending on how specific you want it. Something like this might work: WebAPIServ_[A-Z]{3}_L(1|2)\.\d{8}_\d{6}_\d{3}.log ... View more

Posting here in the hops of saving folks a lot of time and headache. First off: 1.2 DB Connect requires JVM 8 not JVM 7 as in pervious versions of DB Connect v 1.x Download the zip from Microsoft here: https://www.microsoft.com/en-us/download/details.aspx?id=11774 Un gzip and un tar it and located the sqljdbc42.jar file Put ONLY the sqljdbc42.jar into dbx/bin/lib/ folder - Make sure it's the 42.jar not 4.jar or 41.jar Also make sure splunk can access this. Typically I do a chown splunk:splunk to the file after I move it. Copy the database_types.conf from default to local and add in the following stanza: Also note that the testQuery is required, otherwise your connections will fail. [generic_mssql] displayName = MS-SQL Server Using MS Generic Driver jdbcDriverClass = com.microsoft.sqlserver.jdbc.SQLServerDriver connectionUrlFormat = jdbc:sqlserver://{0}:{1};databaseName={2};selectMethod=cursor defaultPort = 1433 defaultCatalogName = master testQuery = SELECT 1 Then update your database.conf in your local folder for each of your mssql databases: [database_stanza] database = database_name host = database_host isolation_level = DATABASE_SETTING readonly = 1 #type = mssql type = generic_mssql username = Splunkservice disabled = 0 password = [encrypted_password] Reboot splunk ... View more

Answering my own question here, to save folks time and agony in finding a solution. Our existing database names contain hyphens and underscores (ex. database-things_are-in-dev) which the migration script fails on, to fix edit the following line in /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/migration/migrations/input/001_migrate_from_dbx1.py Change this: name_pattern = r'dbmon-(?P<type>\w+)://(?P<database>\w+)/(?P<unique_name>\w+)' to this: name_pattern = r'dbmon-(?P<type>\w+)://(?P<database>\S+)/(?P<unique_name>\S+)' Rerun script. Another note you'll need to manually check your migrated inputs, if you used either: interval = auto interval = 24h instead of a cron, those will import, but continue to fail until you manually edit them (similar to how you manually edit the lookups). ... View more

I feel kind of stupid now, but the issue was with my original search, I had been using: Wrong Search: index="aide_index" | extract reload=t | search "Socket" | table _time _raw, value, old_value, new_value Correct Search: index="aide_index" | search "Socket" | table _time _raw, value, old_value, new_value I forgot to remove extract reload=t after refreshing the new transforms.conf file... so it was parsing all those fields twice. ... View more

From your License Master check out: index=_internal source=*license_usage.log type="Usage" idx=default This resulted in some logs which helped us identify the offending systems/hosts as show in the modified logs below: 11-18-2015 19:52:57.182 +0000 INFO LicenseUsage - type=Usage s="/var/log/windows/123.123.123.123/syslog.log" st="syslog-141" h="the_host_name" o="" idx="default" i="85293027-217B-40FF-8D1E-D9177AFECEB1" pool="auto_generated_pool_enterprise" b=402 poolsz=53687091200 We logged into the_host_name syslog box and saw that a few of the stanzas in the inputs.conf file did not have an index specified, so we added our default index (which is main) [monitor:///var/log] disabled = false followTail = 1 sourcetype = syslog whitelist = .log$ index = main After this fix, we've had no further logging to index=default. Why this suddenly started to happen after the upgrade to 6.3... no idea. ... View more

Finally figured this one out. Turns out the permissions were invalid on the file we had just created (they were created/owned by root). To fix we ran a: sudo chown -R splunk:splunk /opt/splunk/etc/...file.conf Then repushed the bundle. And it worked. The other time we had this issue, someone else had one of the conf files open in vim (which automatically creates a .swp file) which prevented the push. ... View more