How is the data getting logged? Remember that Splunk can handle any source of data. Can you provide a full log entry? Is time anywhere in the event? Splunk stores all of the data on the back-end by time. If this is a typical entry then you will probably have to setup some of the following options in the props.conf: [yoursourcetype] SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = ^Rain ... View more

You will need to modify the props.conf with the following (assuming 24-hour clock) : [yoursourcetype] TIME_FORMAT = %m%d%Y %H%M%S Here is a link to more information: http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Configuretimestamprecognition ... View more

According to the docs if you want data to be sent to the null queue than you have to call your stanza in the transforms.conf setnull, ie: props.conf [yoursourcetype] TRANSFORMS-set = setnull, setparsing transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = \'tomcat\' trying to restart DEST_KEY = queue FORMAT = indexQueue ... View more

Looking at the online docs I see the following: Note concerning wildcards and monitor: You can use wildcards to specify your input path for monitored input. Use "..." for recursive directory matching and "*" for wildcard matching in a single directory segment. "..." recurses through directories. This means that /foo/.../bar will match foo/bar, foo/1/bar, foo/1/2/bar, etc. You can use multiple "..." specifications in a single input path. For example: /foo/.../bar/... The asterisk () matches anything in a single path segment; unlike "...", it does not recurse. For example, /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc. However, it does not match /foo/1/2/bar . A second example: /foo/m*r/bar matches /foo/bar, /foo/mr/bar, /foo/mir/bar, /foo/moor/bar, etc. You can combine "" and "..." as required: foo/.../bar/ matches any file in the bar directory within the specified path. Are there files under the DiagnosticStore directory? [monitor://C:\Resources\Directory...DiagnosticStore...] Does this work. Here is the link to more info in the Docs: http://docs.splunk.com/Documentation/Splunk/4.2.4/admin/Inputsconf ... View more

On the first question, I would use the "..." syntax in your monitor stanza. For instance: [monitor://C:\Resources\Directory...DiagnosticStore] On the second question you can use the "..." syntax as well in the prop.conf to pull out only certain files and give them specific encoding. For instance: [source::...KeyValidationWebRole.DiagnosticStore...] sourcetype=awesome Might help to see what the file names under this directory. ... View more

I just added the port 9997 in Manager-->Forwarding & Receiving-->Receive Data-->New The $SPLUNK_HOME/etc/apps/search/local/inputs.conf file was updated with the following: [splunktcp://9997] Make sure you restart the Splunk processes after updating the inputs.conf file on the Indexer. ... View more

Configure the $SPLUNK_HOME/etc/system/local/inputs.conf on the Forwarder (server2) with the following: [monitor:///var/log/system.log] disabled = false followTail = 0 sourcetype = system Restart Splunk $SPLUNK_HOME/bin/splunk restart Restart the Splunk Indexer (server1) $SPLUNK_HOME/bin/splunk restart Now log back in as the "admin" user and select "Launch the search app". Does "server2" show up in the lists of hosts? ... View more

Your inputs.conf and outputs.conf files look fine. I would start with looking at the default Search app. Is the system listed in the Hosts section? Can you run the following search: host=server2.example.com Does any data come back? ... View more

There is a README file in the $SPLUNK_HOME/etc/apps/netflow directory. Here are the contents of that file: Splunk for NetFlow App (v1.2) 3 Splunk for NetFlow App (v1.2) 4 5 Description: 6 Capture netflow binary records, translate them into 7 text files, and then feed to Splunk to produce 8 dashboards and reports. 9 10 Splunk Version: 4.1 and Higher 11 Supported Platform: Linux 12 Last Modified: Jun-2011 13 14 Author: Andrew Thanalertvisuti - Splunk, Inc. 15 [email protected] 16 17 For support, please contact: [email protected] *** Disclaimer *** By default, the NetFlow app only works on Linux 64-bit platforms (due to issues with nfdump binary compatibility). If you want to run this app on 32-bit platforms, rename two binary files "nfcapd_linux32" and "nfdump_linux32" to "nfcapd" and "nfdump", respectively. These files are located in the NetFlow app's "bin" dire ctory, which is $SPLUNK_HOME/etc/apps/netflow/bin . Following is an example of how to rename the files within the directory: $ cd $SPLUNK_HOME/etc/apps/netflow/bin $ mv nfcapd_linux32 nfcapd $ mv nfdump_linux32 nfdump NOTE: You can download the nfdump source code from: http://sourceforge.net/projects/nfdump/ *** Welcome to the Splunk for NetFlow App *** The Splunk for NetFlow App produces dashboards and reports of NetFlow binary records, which are captured using nfdump and fed into Splunk. The app also allows you to search through the NetFlow records using Splunk. The configuration file (config.ini) is located in the app's "default" directory, which is $SPLUNK_HOME/etc/apps/netflow/default/config.ini . The app relies on the sourcetype=netflow. NOTE: It may take up to 5 minutes for new data to show up. For support, please contact: [email protected] ... View more

The props.conf file does not get automatically created in the $SPLUNK_HOME/etc/system/local directory. The $SPLUNK_HOME/etc/system/README/props.conf.example and props.conf.spec have the examples of what is required for the props.conf file. You will need to create the $SPLUNK_HOME/etc/system/local/props.conf file manually. ... View more

According to the Release Notes, FreeBSD 7.x is not officially supported. To install Splunk 4.x you will need to install the compatible FreeBSD 6.x libraries. Check out this Wiki page for more information: InstallSplunkOnFreeBSD7 ... View more

Have you taken a look at the following search commands: outputlookup http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup outputcsv http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputcsv ... View more

The reason that is seems to be slower is the following: The initial summary dashboard in 4.2 is a real time search and updates as long as it is on the screen while 4.1.x is static data. Thanks to Michael Wilde. ... View more