I'm trying to upgrade from 6.2 to 6.4 on a linux server and hitting some pain points. Can someone tell me what I'm doing wrong here? Attempt 1 1) I backed up my Splunk_Home folder (Known as 'splunk') on my local drive 2) I renamed the splunk folder to 'splunkOLD' on that dev server 3) I downloaded this .rpm file splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm 4) I ran this command rpm -U splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm 5) Accepted the license agreement 6) Installed a fresh copy of Splunk which did not retain the user accounts and data, or my conf files.. The UI was available, but I only had access to the admin/changeme creds Attempt 2 1) Splunk_Home folder is still backed up on my local drive 2) I rename that splunkOLD folder back to its original name splunk 3) I ran this command rpm -U splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm 4) It says... warning: splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID xxxxxxxx: NOKEY package splunk-6.4.0-f2c836328108.x86_64 is already installed ... View more

I have a timechart which tracks tax calls per half hour. We have monitoring set up which will hit our web service every 1 minute, there is no way to distinguish between a customer or monitor tax call in that index, it only shows the method and tax call. So I need to subtract 30 from each time slot so I can get rid of the monitoring from our results. I have an extracted field called Tax which is the name of our web service name (CalculateTax and LookupTax). Example BEFORE _time CalculateTax LookUpTax 2016-03-14 00:00:00 143 118 2016-03-14 00:30:00 151 111 2016-03-14 01:00:00 103 96 2016-03-14 01:30:00 125 98 AFTER _time CalculateTax LookUpTax 2016-03-14 00:00:00 113 88 2016-03-14 00:30:00 121 81 2016-03-14 01:00:00 73 66 2016-03-14 01:30:00 95 68 Here's my current query index=vertex7-access Tax="*" | timechart count by Tax ... View more

We want an alert anytime a forwarder stops sending data or the service stops. I've installed the Splunk Deployment Monitor app and tested this by stopping the service on a forwarder and for about 15 minutes the app showed the forwarder as active then it disappeared from the list. My ideal situation would be for it to show as Inactive and have it send an alert that a forwarder is down. After researching I saw that if we upgrade to 6.3 then that will have a native app built in which will let us know when a forwarder is down. So my question is, should we continue using our 6.2 version and put more time into configuring the Splunk Deployment Monitor app or should we upgrade to 6.3 and use that native app? Is the native app is 6.3 more intuitive then the Splunk Deployment Monitor app? We're currently running version 6.2 Edit: That native app I was referring to was Distributed Management Console (DMC).. I see now that it's installed in my 6.2 version already. Can anyone advise how I can set up alerting inside this app to tell us if a UF is down? ... View more