Oh, you want to route each event with different value to a different index? I thought, you want to look for specific value in the raw events and route all the events which have this specific value to different index(s). ... View more

Can you provide some more information like screenshots of your search and results. The reason I ask is, head command is working perfectly for me. my search | head 10000 stops running as soon as it hits 10k results. ... View more

Yes. Using props.conf and transforms.conf , you can achieve this. Please provide some sample data to perform regex matching. Otherwise, below is the basic structure of configuration settings for routing events. Props.conf: [your_custom_sourcetype] TRANSFORMS-routing = routing_based_on_field_values Transforms.conf: [routing_based_on_field_values] REGEX = <your_custom_regex> DEST_KEY = _MetaData:Index FORMAT = <alternate_index_name> You can find more information in below links, let me know if this helps. http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Setupmultipleindexes#Route_specific_events_to_a_different_index https://answers.splunk.com/answers/566448/route-specific-events-to-a-relative-index.html ... View more

If all reports and dashboards are under one app, then you can set read permissions at app-level. Below are some links to get you started. http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Manageknowledgeobjectpermissions#Restrict_knowledge_object_access_by_app_and_role http://dev.splunk.com/view/webframework-developapps/SP-CAAAE88 ... View more

Hello @siva_cg, Here you go, http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Extractfieldsfromfileswithstructureddata#Props.conf_attributes_for_structured_data ... View more

After checking splunkd.log for errors, also check for any typo's in your configuration files. Splunk doesn't start if it encounters any typo's or mistakes in critical configuration settings. You can use btool to troubleshoot your configuration files. HTH! ... View more

Hello sbridge, For managing inputs.conf, you can install an UF on the one server where logs from all your other servers are stored (/mnt/logs/shorthostname) and then manage it with DS. Your other two questions: Yes. You can use host_segement to in your monitor stanza to capture hostnames from file path. Sourcetypes can be defined freely in inputs.conf with whatever name you want. You don't need a configuration setting to set sourcetype. This is how your inputs.conf looks like: [monitor:///mnt/logs/shorthostname1] host_segment = 3 sourcetype = any_sourcetype_name_you_like [monitor:///mnt/logs/shorthostname2] host_segment = 3 sourcetype = any_sourcetype_name_you_like ... View more

Modify your monitor stanza to below: [monitor://D:\Splunk\Logs\uVisit\dd\Visit*.log*] disabled = false sourcetype = dd OR [monitor://D:\Splunk\Logs\uVisit\dd] disabled = false whitelist = \.log\.\d+|\.log$ sourcetype = dd ... View more

Hello muhammadamir, It is hard to figure out the issue without looking at your settings. However, to test email alerts, you can use "sendmail" search command. ... View more

Hello, Can you provide more information about your configuration settings. For starters, inputs.conf and props.conf ... View more

Indexing exported windows event logs have some limitations, due to Microsoft proprietary way to generate those .evt files. Windows event log (*.evt) files are in binary format. You cannot monitor them like you do a normal text file. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files. Splunk Enterprise uses the following stanzas in inputs.conf to monitor the default Windows event logs: # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 From another answer - workaround - maybe, you can try to convert these files to text files or csv files and upload to splunk. http://serverfault.com/questions/783708/convert-saved-evtx-files-to-text ... View more

No. In \etc\apps\Splunk_TA_windows\default\inputs.conf, perfmon input is not explicitly disabled which means, no one is telling splunk to disable 'perform' at higher precedence level and hence, system/default(least precedence) is applied to these inputs. In short, yes, you should add the input and disable it at a higher directory structure. ... View more

Hello @neerajshah81, Splunk on Windows ships with several Windows-only inputs. They are defined in the default inputs.conf and are enabled by default. You should explicitly define the monitor input like below, under etc\apps\Splunk_TA_windows\default\inputs.conf, to overwrite default settings. I've had the same issue in the past. You can find more information on default settings here. [perfmon://<name>] disabled=1 ... View more

Hi Log_wrangler, Yes, you can achieve this by using props.conf. Be sure to push this to both UF and HF. [source::your_source] TZ = US/Central ... View more

Hello lightech1, Heavy forwarders have capabilities to parse and route data before indexing. Unlike other forwarder types, a heavy forwarder parses data before forwarding it and can route data based on criteria such as source or type of event. It can also index data locally while forwarding the data to another indexer. Please refer to splunk docs for more information. HTH! ... View more

@ahmemohs03, I see you're getting good help from the folks here. But, let me ask you some questions, 1. Can you ping your indexer (Linux A) from your forwarder (Linux B) and vice versa? 2. Did you check to see if ports 9997 and 8000 are open on Linux A? ... View more

Thank for the events. Give this a try. The rex here creates a new field called "new_subject". source=* dest_port=25 | rex field=_raw "Subject\:\s(?<new_subject>.+)" | eval count=mvcount(new_subject) | stats sum(count) as totalOccurrence ... View more

Hello @weicheng98, Is it possible to provide some sample events. I think there might be a mistake in your rex statement. ... View more

Hello @vidhyaArumalla, Based on the sample data, below configuration should get you started. Please note that, I am using DATETIME_CONFIG = NONE setting because, there is no timestamp available in the sample data. If this is the case with real data, this setting will leave the event time set to whatever time was selected by the input layer(for ex: Universal forwarder). If timestamp is available in data, then you should use TIME_FORMAT & TIME_PREFIX settings to explicitly extract timestamps. Let me know if this helps. Props.conf [custom_sourcetype_XML] KV_MODE = xml LINE_BREAKER = ([\r\n]+)\<result\> SHOULD_LINEMERGE = false DATETIME_CONFIG = NONE EXTRACT-State = \<u\_State\>\s*\<display\_value\>(?<State>\w+)\<\/ EXTRACT-City = \<u\_city\>\s*\<display\_value\>(?<City>\w+)\<\/ ... View more

This may be because of "srchIndexesDefault" setting for a user. srchIndexesDefault - is a semicolon-delimited list of indexes to search when no index is specified. So, if you don't specify the index name in your search, splunk will look at default indexes to search. Hence, inconsistencies in results. Below is more information of this setting: srchIndexesDefault = * A semicolon-delimited list of indexes to search when no index is specified. * These indexes can be wild-carded (""), with the exception that '' does not match internal indexes. * To match internal indexes, start with ''. All internal indexes are represented by ''. * The wildcard character '' is limited to match either all the non-internal indexes or all the internal indexes, but not both at once. * If you make any changes in the "Indexes searched by default" Settings panel for a role in Splunk Web, those values take precedence, and any wildcards you specify in this setting are lost. * Defaults to none. ... View more

Based on sample data, your SEDCMD setting should be adjusted a little. Below is the modified version. Give it a try... SEDCMD-ssn = s/(social_security_number..:..)\d{9}(\\")/\1xxxxxxxxx\2/g Please note that data can't be modified once indexed. This mask will be effected to new events. You can find some information here: https://answers.splunk.com/answers/22835/how-can-we-anonymize-user-date-at-search-time.html ... View more

Hi ronerf, Your configurations looks good. Can you provide sample event(s) to see why these configurations doesn't work. Also, please remember that these configurations should be applied to both source and destination of the data, which means in a typical deployment, configs should be present on universal forwarders, heavy forwarders (if you're using this) and indexers. ... View more

@Hemnaath, since you're seeing this message on search heads (which I assume are part of search head cluster), run the below linux command from deployer to get an idea about the size of lookup files. From your deployer, find $SPLUNK_HOME/etc/shcluster/apps/ -type f -name '.csv' -exec du -sh {} +;* The default value of lookup file may be 10 MB, I am not 100% sure about this. More details here, under lookup stanza. ... View more

Hi ZellNorman, Yes. Splunk saves all logs in a directory based structure called 'index' (in splunk's language). If you did not define any index while configuring your inputs, then splunk will store everything into 'main' index by default. Yes. You can specify index name in your inputs.conf file. Locate appropriate inputs.conf file usually located under $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps/local directories and define as below: Under inputs.conf: [monitor:///custom_path_to_log_files] index = your_custom_index_name sourcetype = your_custom_sourcetype_name ## Sourcetype is used to differentiate data types in a single index. Highly recommended by splunk to use assign the right sourcetype while configuring your inputs. More info @ http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Listofpretrainedsourcetypes And finally, Yes. splunkd.log it is. Also, you can check metrics.log file for information about data thruput and dest-source connectivity and more. Hope this will get you started. ... View more

Can you please paste your configurations here. ... View more