Just noticed that myself, updated answer to reflect splunktcp, which functions in the same manner. ... View more

Well, per inputs.conf you can configure things in this manner: [splunktcp://[remote server]:port] * This input stanza is used with Splunk instances receiving data from forwarders ("receivers"). See the topic http://docs.splunk.com/Documentation/Splunk/latest/deploy/Aboutforwardingandreceivingdata for more information. * This is the same as TCP, except the remote server is assumed to be a Splunk instance, most likely a forwarder. * 'remote server' is optional. If specified, will only listen for data from 'remote server'. If you have a lot of forwarders, that might not be the best solution. My first instinct would actually be to use a local firewall to accept connections on tcp/9997 from only known forwarders and keep security separate from Splunk. ... View more

If you're saying that you'd like to define a sourcetype at the input level, that is certainly possible. from inputs.conf.spec sourcetype = <string> * Sets the sourcetype key/field for events from this input. * Primarily used to explicitly declare the source type for this data, as opposed to allowing it to be determined via automated methods. This is typically important both for searchability and for applying the relevant configuration for this type of data during parsing and indexing. * Detail: Sets the sourcetype key's initial value. The key is used during parsing/indexing, in particular to set the source type field during indexing. It is also the source type field used at search time. * As a convenience, the chosen string is prepended with 'sourcetype::'. * WARNING: Do not quote the <string> value: sourcetype=foo, not sourcetype="foo". * If unset, Splunk picks a source type based on various aspects of the data. There is no hard-coded default. I am not entirely sure what your asking, but if you tell splunk via an input stanza to monitor a particular file/directory, and you specify a sourcetype, any data handled by that input stanza will have the specified sourcetype assigned to it's metadata. ... View more

That means we didn't read the file because there is another file that has the same crc. This indicates the first 256 bytes of the file are the same as another file already read. In this input stanza you can put in this option to force splunk to include the source name as well as the crc: crcSalt = ... View more

First, check splunkd.log for messages from the WatchedFile and TailingProcessor components looking for anything related to error_delta.log. Hopefully this tells you what is happening, but it might not tell you anything at all. If this solves the problem, great! If not, then Second,From $SPLUNK_HOME/bin you can run ' splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus > output.txt ' look at output.txt for the error_delta.log, if it read the file, it'll tell you how far into the file we read and the size at the time of reading. If it ignored the file it'll say why we ignored it. If it says we read the file and it isn't showing up, try searching in a very non specific way for something in particular which you'd expected to see but didn't, with a search like this: 'index=* <uniquedata>' over all-time via the search app. It's possible the timestamp is being misinterpreted or the metadata isn't matching for some reason. ... View more

I just checked mine, and the data appears to be binary. So Splunk isn't going to read it. You could send NO_BINARY_CHECK to process the files using props.conf though. ... View more

From $SPLUNK_HOME/bin you can run 'splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus > output' and then search output for the files in ASL, it'll tell you why they're ignored or if they've been read. ... View more

Well, server.conf generally isn't something you'd deploy via a Deployment Server. Inputs.conf generally would be deployed via an app managed by DS. But, if you deleted server.conf, and had server specific settings, they'd get trashed. This is really the only reason to avoid making this type of a change. ... View more

In 10.8, data is logged to asl(syslog) instead of secure.log, so it would be something like this: ./splunk add monitor /var/log/asl ... View more

Inputs.conf contains the inputs that specify what you'd like splunk to do in terms of files to monitor, scripts to run, etc. Server.conf provides contains the set of attributes and values you can use to configure server options, and are often times specific to the system. Deleting them will cause any of the custom settings that have been put in place intentionally or otherwise, to be deleted. Files may or may not be created on restart, depending on the conf file in question, but the custom settings in place will be lost. ... View more

You can forward data from one instance of Splunk to another with outputs.conf, but you can't do it based on age. If you needed to do that, you'd have to rsync/scp the files from one instance to the other and then merge the data into the indexes where they should exist with some kind of script. To migrate the individual buckets, you can use the procedure outlined here: http://splunk-base.splunk.com/answers/23536/moving-indexes-to-a-new-splunk-server ... View more

This script provides ps like output which can be useful in troubleshooting memory/CPU type issues..and is different from the data you'd get from WMI as it'll be used to populate graphs within the SOS app, which won't happen with WMI data. ... View more

If I understand what you're looking for correctly, I believe the answer to your question is search time field extraction, which is documented here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime ... View more