Please check if your windows app is correctly setup. By default the functionality to resolve Objects names using AD is enables, but the AD name is not filled. " If you've added some non-standard event log channels and you want to specify whether Active Directory objects like GUIDs and SIDs are resolved for a given Windows event log channel, you can turn on the evt_resolve_ad_obj setting (1=enabled, 0=disabled) for that channel's stanza in your local copy of inputs.conf. evt_resolve_ad_obj is on by default for the Security channel." the default is [default] evt_resolve_ad_obj = 1 evt_dc_name = evt_dns_name = and to fix it you have to edit $SPLUNK_HOME/etc/apps/windows/local/inputs.conf : disable the windows app (but it's radical) disable AD name resolution it with [default] evt_resolve_ad_obj =0 or keep AD name resolution but configure the 2 parameters evt_dc_name = MYADSERVER.MYDOMAIN.COM # second is optional evt_dns_name = the_Fully-qualified_DNS_name_of_the_domain see examples here http://www.splunk.com/base/Documentation/latest/Admin/Inputsconf and here http://www.splunk.com/base/Documentation/4.2/Data/MonitorWindowsdata ... View more

Here is the method. On the indexer side (or the regular forwarder) in /local/props.conf [sourcetypeofyourdata] TRANSFORMS-changesource = removetimestamp in /local/transforms.conf [removetimetamp] SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Source REGEX = (.*?)(_\d{8}T\d{6}_\d{6})(\.log) #use a regex to extract the filename FORMAT = source::$1$3 to explain here is the regex in action : mypath\userentrypoint17_20110309T143708_170500.log is cut in $1: mypath\userentrypoint17 $2: _20110309T143708_170500 $3: .log and we throw away the $2 ... View more

An easy approach is to compare count per day. by example to see the number of error per hosts over a week, and generate a nice graph error earliest=-7d@d | timechart span=1d count by host useother=0 You also can use summary indexing to save your results every day instead of recalculate them every time : http://www.splunk.com/base/Documentation/4.1.7/Knowledge/Usesummaryindexing with a scheduled search, running every day at midnight (+15 minutes to make sure that all your data is available) example my saved search "summary_error_daily" with the "si" version of the timechart and a more precise detail (per hour) error earliest=-1d@d latest=@d | sitimechart span=1h count by host useother=0 then call the results with index=summary name=summary_error_daily | timechart span=2d count by host Another method is to use the alerting, run a stats count by host search, the use the condition with the "if number of host rise by 1" let it run one day (to store the first values), then it will fire email alerts see http://www.splunk.com/base/Documentation/latest/Admin/HowdoesalertingworkinSplunk ... View more

To call a macro from the cli, please use the escaped ` characters. (not ' not ") example to call the macro testmacro in the GUI: index=_internal | `testmacro` | table itime in the CLI: splunk search " index=_internal | \`testmacro\` | table itime " ... View more

Simple, add the "useother=0", you will have the complete list of your columns (but it can be confusing if you have too much). by example : | timechart span=1d count by host useother=0 ... View more

Actually, not being in the supported list means that : It's just not tested Only the file-systems we actually test on are listed as 'supported' in the docs as those are the one we KNOW to work with Splunk. All other file-systems will likely work, but it's on a best-efforts basis only. Any fs-related issues that pop up will be pre-cluded from an fix/workaround SLA commitments. In order to run on an unsupported file system, you have to bypass the 'locktest' check that runs on startup – a symlink is the easiest way to do this. As always, our support agreement is with the Customer, so we will do as much as possible to help them get up and running, but if they choose to use a file system that is untested & unsupported, we can only do so much. ... View more

Those useful graphs and searches are already included in your search app. see the status menus. (for recent versions 4.1.* and above) Every time, you can click on "view results", the search will be displayed and you can dig from that. ... View more

use splunk to call btool, the library will be the splunk ones, not the system ones. by example, to check the list of the inputs cd $SPLUNK_HOME/bin ./splunk cmd btool inputs list --debug ... View more

A good answer in the wiki http://www.splunk.com/wiki/Deploy:BucketRotationAndRetention What's an index First of all, you have to know that every index has his own locations and settings. The maximum size of your data on a volume will be the sum of all the indexes stored on this volume. The default index is called "main", but you may have created others, or specific apps may have their own. Splunk also uses his own indexes (_internal, _audit, history, summary ....) What's a bucket Second thing, a bucket is a unit of indexed data; it is physically a directory containing events of certain period. You may have several buckets at the same time in each stage. See details here http://www.splunk.com/base/Documentation/latest/Admin/HowSplunkstoresindexes Example of default path decomposition of the main index : $SPLUNK_HOME/var/lib/splunk/db/defaultdb/colddb/db_1288199229_1280423250_10/rawdata/94376288.gz * defaultdb is the index * db is the location for the buckets in the cold stage (also called the database location) * db__ is a specific bucket directory Bucket stages A buckets rolls from a stage to another depending of certain conditions : Hot -> Warm -> Cold -> Frozen (-> Thawed) * From hot to warm if his size reached a limit `maxDataSize` or his lifetime is older than `maxHotSpanSecs`, or using a manual command to roll the buckets. * From warm to cold once the number of maxWarmDBCount is reached, the older will be rolled. * From cold to frozen, once the `maxTotalDataSizeMB` is reached (for hot+warm+cold) or once the `frozenTimePeriodInSecs` reached. Those buckets will be deleted, except if you defined a `coldToFrozenScript` to archive them somewhere. Bucket's location The different stages of an index may all have a specific location; this is how you can spread your data on different volumes: * `homePath` location for the Hot and Warm buckets * Hot (intensive read and write, this is where the indexation occurs) * Warm (mostly read, and optimization) * `coldPath` location for the Cold buckets (moved once, then read, used for searches only) * `thawedPath` location for Thawed buckets (used only if you want to re-import frozen buckets) * There is no Frozen location defined in Splunk, because the default action is to delete them. SPOILER: In Splunk 4.2 it will be possible to split a location between several volumes, useful if you can't dynamically extend your disk partitions. Recommendations A recommended setup will be to define homePath on your local high speed read+write raid1+0 disks, to define coldPath on the slower disks with a good read speed (RAID5) or remote volumes, and if you defined a coldToFrozenScript , to move the frozen buckets on compressed backup tapes. Be aware that the performances of Splunk will depend of the performances of the storage : * indexation performance : linked to the write speed on the `homePath` location * search performance : linked to the read speed on the `homePath` and `coldPath` location. By example : doing searches on long periods, using old data stored on remote volumes will be slower than doing a specific search on recent events on the local high speed volumes. Example with the default settings Now let's see the size you should to reserve for the main index. see the default configuration file $SPLUNK_HOME/etc/system/default/indexes.conf # global parameters maxDataSize = auto # 750Mb for auto, 10GB for auto_high_volume maxWarmDBCount = 300 maxHotSpanSecs = 7776000 # after those time, the hot bucket will be rolled to warm frozenTimePeriodInSecs = 188697600 maxTotalDataSizeMB = 500000 [main] homePath = $SPLUNK_DB/defaultdb/db coldPath = $SPLUNK_DB/defaultdb/colddb thawedPath = $SPLUNK_DB/defaultdb/thaweddb maxMemMB = 20 maxConcurrentOptimizes = 6 maxHotIdleSecs = 86400 maxHotBuckets = 10 maxDataSize = auto_high_volume # 750Mb for auto, 10GB for auto_high_volume Space taken by the whole index The maximum size of all buckets for an index is maxTotalDataSizeMB . Space taken by the hot+warm buckets The maximum size for the hot+warm of the main index will be: * (maxWarmDBCount + maxHotBuckets ) * maxDataSize * (300 + 10 )*750MB = 227GB for auto * (300 + 10 )*10GB = 3100GB for auto_high_volume Space taken by the cold buckets Therefore the maximum size of the cold buckets will be: * maxTotalDataSizeMB - "size of the hot+warm buckets" * 500GB - 227GB = 273GB for auto * 500GB - 3100GB = - 2600GB for auto_high_volume, you probably will never have any cold buckets !!! Space taken by the frozen Buckets ... wait there are none ! In the same time, the buckets with all events older than frozenTimePeriodInSecs ~ 6 years are removed from warm and cold and deleted or archived out of Splunk. Stop splunk if remaining size is too small /# defined in server.conf minFreeSpace = 2000 # in MB by default It's a good way to stop indexing if the size on the warm+hot volume is too small. If splunk is installed on windows c: it's a good idea to increase this value to at least RAM*2. Voila ! You should have enough elements to choose and configure your Splunk bucket policy. Remember to redefine your own configuration in $SPLUNK_HOME/etc/system/local/ instead of touching the default files. And look into $SPLUNK_HOME/etc/system/README/ for configuration examples and explanations ... View more

Hi Mata It seems that you encountered the deprecated "_actions" index from the old index_server app. A quick way to fix it is to comment the line starting with : _actions in $SPLUNK_HOME/etc/apps/index_server/default/indexes.conf If you can't find the line in this specific configuration file, you can use the following command to find it : find $SPLUNK_HOME/etc -name indexes.conf | xargs grep ^_action then restart splunk. ... View more