well, you don't need to explicitly specify source=/var/log/syslog in your inputs, your monitor path with be the source in this case.(eg.: source=/var/log/rsyslog/(ip or hostname)/syslog) since sourcetype=syslog is a pre-trained sourceytpe within Splunk, you might have to check if any configs are overriding your configs.. ./splunk btool props list --debug <sourcetype> ./splunk btool props list --debug syslog checkout this splunk blog for reference... https://www.splunk.com/blog/2008/04/16/overriding-default-syslog-host-extraction.html ... View more

@tacomadcsb6mt : comment or accept this as an answer for future readers. ... View more

Take a look at this splunkanswers, this should be a good start to alert based on your use case... https://answers.splunk.com/answers/449029/how-to-alert-when-a-forwarder-is-not-sending-logs.html https://answers.splunk.com/answers/48252/alert-if-any-forwarder-stops-sending.html try this Meta Woot app from splunkbase... https://splunkbase.splunk.com/app/2949/ ... View more

Hope this works... index=<index> sourcetype=<sourcetype> | lookup userlist.csv username as workstation_name OUTPUT username, fullname | table username fullname workstation_name ipaddr ... View more

@blaise: I tested it on my local with your sample data, it's working for me, except you need to make changes to TIME_FORMAT based on your requirements... ##this configs should be on indexers(data parsing happens on indexers) props.conf [autosys_events_prod] SHOULD_LINEMERGE = false TIME_PREFIX = ^\[ TIME_FORMAT = %d/%m/%Y %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 19 try running this command to check all the props in that particular app... ./splunk btool props list --debug ./splunk btool props list --debug --app=search ... View more

How about this.. | rex "line1\=(?<name1>[\w+]+)" | rex "line2\=(?<name2>[\w+]+)" | eval fullname=name1." ".name2 | xyseries fullname date_hour count ... View more

It won't reindex the same file again once it's indexed, you have to reset the checkpoint of a specific file or delete the fishbucket(this will reindex all data on that box) https://answers.splunk.com/answers/46780/reset-splunkforwarder-to-re-read-file-from-beginning.html ... View more

Did you try crcSalt = ..?? using recursive depends on whether or not to monitor subdirectories.. recursive = <boolean> * Whether or not the input monitors subdirectories that it finds within a monitored directory. * If you set this setting to "false", the input does not monitor sub-directories * Default: true. What's your directory structure in your monitor stanza..?? Can you run this commands to check the status of your file... ./splunk list monitor ./splunk list inputstatus Can you post a sample csv data, and also is there any specific reason to use HEADER_FIELD_LINE_NUMBER in props..?? ... View more

It's something to do with the file header, where splunk is thinking that it has already read the file.. you can either increase the initCrcLength or use crcSalt = [monitor:///home/reports/*.csv] recursive = true index = main sourcetype = rf ##defaults to 256bytes initCrcLength = 1024 ##if the above setting didn't work crcSalt = <SOURCE> read this Splunk doc for more info... http://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/Inputsconf#MONITOR: ... View more

This should work, give it a try.... [autosys_events_prod] SHOULD_LINEMERGE = false TIME_PREFIX = ^\[ TIME_FORMAT = %m/%d/%Y %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 19 ... View more

I hope one of this should work, if not you need to check if there is a space at the beginning of each event.. [test:app] NO_BINARY_CHECK = true BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2},\d{3} TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N MAX_TIMESTAMP_LOOKAHEAD = 25 [test:app] NO_BINARY_CHECK = true SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2},\d{3}) TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N MAX_TIMESTAMP_LOOKAHEAD = 25 ... View more

How about this doc.. http://docs.splunk.com/Documentation/ES/5.2.0/Install/DeploymentPlanning ... View more

On your note, just an FYI on a fieldalias incorrect behavior from 7.2.x versions... https://answers.splunk.com/answers/693737/splunk-720-field-aliases-incorrect-behavior.html ... View more

Did you check to see any data exists in the path you mentioned in monitor stanza..?? Run a all time search in case the timestamps are off index=main sourcetype=tomcat* ... View more

I don't think there is a difference in this case form 6.5.3 and 7.21... http://docs.splunk.com/Documentation/Splunk/6.5.3/Security/Addandeditroleswithauthorizeconf you could also test it on your local splunk instance creating a user assigning a role(with inherited role) ... View more

This seems to be an issue with ulimits.. https://answers.splunk.com/answers/105292/what-is-the-cause-of-these-socket-errors-reported-in-splunkd-log-since-upgrading-to-6-0.html https://answers.splunk.com/answers/204320/httplistener-socket-error-from-127001-broken-pipe.html https://answers.splunk.com/answers/105292/what-is-the-cause-of-these-socket-errors-reported-in-splunkd-log-since-upgrading-to-6-0.html https://answers.splunk.com/answers/204320/httplistener-socket-error-from-127001-broken-pipe.html ... View more

How about a tweak in the order of blacklist... blacklist1 = EventCode="5152" Message="*" blacklist2 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist3 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist4 = EventCode="4932" Message="*" blacklist5 = EventCode="4933" Message="*" ... View more

Hope this Splunk answer helps... https://answers.splunk.com/answers/403257/how-to-run-a-dashboard-search-in-verbose-mode-thro.html ... View more

what's the workflow in your case.. UF---->Indexer----->SH try to look at the uf internal logs if they are talking to the indexers index=_internal TcpOutputProc I would login to the indexer and search for the index OR look under /var/lib/splunk/(your index)/db/*/rawdata if you see any data on the indexer db itself to make sure the data is getting to the indexer. ... View more

Either for inline or saved report(saved in verbose-mode), when you add them to a dashboard, by default they are converted to Fast Mode. ... View more

Looks like splunk picked up the file, I would do a all time search on the index in case the dates are off in the source file. index=_internal host=ufhost component=TailingProcessor look for event_message if you can see your source path in the logs...hope this helps. ... View more

we are on 7.2.1, it seems like a bug introduced in 7.2 and higher versions. I guess the only way is to do is a quadruple click as you already figured it out OR I would copy the xml code to a text editor. ... View more

which version of Splunk are you on..?? we started seeing this messages when we upgraded from 7.0.3 to 7.2.1, take a look at this splunk answer... https://answers.splunk.com/answers/49525/splunkd-log-error-message.html find /opt/splunk/ -name local.meta -exec grep nobody {} \; -print when i ran the above command, most of them were form /etc/apps/learned either from Search Heads or DMC. ... View more