you should be using timechart on _time field timechart latest(_time) as "Completion_Time" | convert ctime("Completion_Time") | . . . the convert ctime converts _time to a human readable format for you. ... View more

Each of the Splunk Add-on apps here would get deployed to all of your search head nodes as well as indexer nodes. Splunk DB Connect, to my knowledge still isn't completely proven in a search head cluster, so it would be best to get this installed on a single search head server. The rest of the apps you have listed all have visual components, and should get deployed to your search head cluster nodes. ... View more

you can't perform an operation "as _time" you could do something like this: stats first(_time) as Time . . . ... View more

If you wanted to send to a central server first, before sending into splunk for indexing, a better approach would be to still use the Splunk universal forwarders to send data, but install splunk on that central server and configure it as a Heavy or Intermediate forwarder. It would centralize the collection of your windows log data, and it can pre-parse any data you want before forwarding on to indexers. You would be able to use internal splunk logs on that Heavy Forwarder to validate log data is being sent. Installing UFs is very trivial and does not add much complexity or load to servers. Configuring splunk deployment server to manage configs of UFs makes managing them as a group pretty easy. ... View more

You definitely lose some reliability and fidelity if you try to convert the log data to syslog then send it. You need to determine how much index volume you have available and make sure the load won't take you over the limit. Installing a UF along with the Splunk_TA_windows with the inputs that you want enabled is the easiest and most recommended, especially if you are using the deployment server to manage your UF splunk configs. The UF has a small footprint, so shouldn't present an issue to the end clients. Splunk scales to whatever load you throw at it, whether it be from syslog or UF feeds. The only challenges (and this would be a challenge no matter what method you use to send the event data) is that if you have a distributed environment, you need to assure all of the clear network paths from the UFs to Indexers (or heavy forwarders) to send the event data. ... View more

We need to know what types of logs you have available. If you have authenticated proxy logs, they would be helpful. Some firewalls provide authentication information as well, such as Palo Alto firewalls. The most common source of logs for this type of reporting are proxy logs. ... View more

Take a look at this answer: http://answers.splunk.com/answers/41648/linebreakingprocessor-truncating-line-because-limit-of-10000-has-been-exceeded.html It may address your occasional truncation issue. Looks like you have TRUNCATE= set to Splunk's default value. ... View more

If you use NOT, try using parens around the search string you are trying to exclude. I've also seen it make a difference whether you are using a raw search or a datamodel / tstats search. When using !=, make sure to be specifying a field, such as query !="*.arpa". There are plenty of times, I have to monkey around with the order of my syntax, but ultimately, I can get data excluded from search results. Just be careful with your use of wildcards, quotes and make sure that the field names actually exist when using != ... View more

It won't be part of the installation any more after your uninstall, but there will likely be some cleanup that needs to be done, depending on how your environment is set up. Most of it will be house keeping type things. Some examples of this will be if you were using the distributed management console, you would need to remove the search head as a search peer to keep it from alerting in the console. If you are using the sos app, /opt/splunk/etc/apps/sos/lookups/splunk_servers_cache.csv to get it out of the list on the sos app. If you were forwarding its logs to indexers, you will still see it show up in some internal searches if activity has occurred on it in the recent past. etc. ... View more

The inputs.conf format for Windows eventlogs changed from splunk v5 to splunk v6. Did you uprade the version of the UF on your domain controller? If so, you'll have to use the new inputs.conf format on them which is included in the newest Splunk_TA_windows. ... View more

I recently had to do the same thing and here is what I had to do to get it to work. The two main things that you are missing here is that sparkline is dependent on _time and I have also noticed that to work with the tstats data model searches, I've also needed to manually specify span=. So, this worked for me: Top DNS Servers | tstats summariesonly=t allow_old_summaries=t count(DNS.query_count) as "Number of Transactions" from datamodel=Network_Resolution groupby host _time span=1s | rename host AS "Server IP" | stats sparkline count by "Server IP" | rename sparkline as Activity count as "Number of Transactions" | sort 10 - "Number of Transactions" Hope this helps ... View more

Most of the time I see ext4, however, I've also seen xfs used for indexes without issue. I personally haven't witnessed a huge efficiency gain of one over the other. ... View more

you can use the btool command to see which inputs.conf directives are applied on your Universal forwarder: splunk btool list inputs This will show you what stanzas from inputs.conf are currently being applied. To give more help, we would need to see a sample of the inputs.conf file that is working, along with the path to the conf file as well as the same information from one of your inputs.conf files that is not working as expected. ... View more

I have not figured out a fix for this myself, however I have seen a more reliable field for page count, and that is total_pages. In my searches, where I use printmon, this seems to be a more accurate measure of the print job. ... View more

The only ways that I can think of to apply it to some hosts and not others would be to assign a custom sourcetype to the windows event logs coming from the servers that you want to filter out, and in your props/transforms, assign the transform to that custom sourcetype. Or, you could stand up a heavy forwarder between the UFs and the Indexers, deploy the transform to the heavy forwarder (assigned to the normal sourcetypes) and then, forward just the UFs that you want filtered to the Heavy Forwarders, which will parse the events, then forward on to the indexers. If you create a custom sourcetypes, I would call it something like WinEventLog://Security_filtered, so that you can still perform searches like sourcetype = WinEventLog://Security* and get all your events, whether they were filtered or not. ... View more

No, they would get filtered out before being indexed. ... View more

You can configure MVM to dump scan reports to a directory in csv format. At that point, a Universal Forwarder can very easily ingest those scan results. Then you could configure a sourcetype for them and use a props/transform to assign fields via the header row of the csv. That is a much easier way of grabbing these than using DB connect. ... View more

It could be dependent on many things, your indexing volume per day, the number of indexers, their hardware and performance, the number of cores in your search head, as well as the type of search being run. Could you specify the amount of indexing volume (or your license volume per day) as well as the number of indexers, the hardware assigned to your search head and an example of a slow search? ... View more

looks like in this case, you'll just have to use a wildcard earlier in your statement. Will it still work if you use: [monitor:///opt/log/192.168.*.(37|38|39|40)/Juniper.log] I have consistently run into issues with tailing wildcards when configuring multiple file monitors to act recursively from a higher point in the directory tree. ... View more

Have you tried running the powershell scripts manually on the Windows server in question to verify an error is not occuring, and if output is being created correctly? (ie, all required powershell commandlets installed, etc.) ... View more

I'm pretty sure this is because a file monitor is a regex, and your override is happening because you are using * as a wild card at the end of the same directory level. The 1st file monitor that matches will take precedence. Try defining your file monitors like: [monitor:///opt/log/192.168.1.(37|38|39|40)/Juniper.log] and [monitor:///opt/log/LoadBalancer0(2|3|4)/*.log] ... View more

I've always used a transform for this, but now it looks like UF v. 6.1 introduced this type of blacklisting as a new feature. Check out this blog post for what looks like a good example: http://blogs.splunk.com/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log/ ... View more

Whitelist/blacklist operates on the file level, i.e. which files to include/exclude for indexing. If you are looking to black list particular event ids out of a log file, you need to define a transform in a transforms.conf file and call it with a props.conf file on a heavy forwarder or indexer that your event will pass through. for example: props.conf - [WinEventLog://Security] TRANSFORMS-send_to_nullqueue = send_to_nullqueue transforms.conf [send_to_nullqueue] DEST_KEY = queue REGEX = EventCode=5156 FORMAT = nullQueue These can be deployed via their own configuration app, or include them in the /local of the Splunk_TA_windows if you are using that. ... View more