It's recommended to upgrade to 4.2 first, then from 4.2 to 5.x. See here: As you said, the Windows to Linux migration complicates things... If it were me, I think I'd upgrade your existing installation to 4.2, then to 5, and then migrate your data/knowledge over to a new Linux install. You may be able to get away with just migrating your stuff over from your 3.x install to a new 5.x install, but there have been enough changes in the two major revisions that you'd probably be chasing errors for a while. ... View more

mspiegle, I'm not sure how to match the timezone offset with the colon in it. You've used %:z, though the link that you posted mentions only %z, %::z and %:::z. I've used %z (which matches offsets like +0400), but not the others. It may work as you've got it if the events were linebreaking properly. You might want to try this in your props.conf stanza: LINE_BREAKER = ([\r\n]+)(?\d{4}-\d{2}-\d{2}T) Assuming you keep the same date format. And I'd throw that MAX_TIMESTAMP_LOOKAHEAD back to 25, but that's just the OCD personality in me speaking... 🙂 ... View more

ok, a couple things I'm seeing here. Not sure if any of them will actually fix your problem. In your inputs.conf, your monitor statement looks weird. Is this a Windows system? If so, I'd expect to see something like: [monitor://C:\blah] Also, in your props.conf, I'd again expect to see a drive letter, but also, I think you meant to put: [source::C:\blah] Finally, and this definitely doesn't have anything to do with the issue, in your EXTRACT statement, you have: ...(?P [^,]+),,?... but I think you should probably have: ...(?P<serviceName>[^,]+),?... You had an extra comma in there. That may have just been a typo in your writeup though. Otherwise, I don't really see why what you have wouldn't work. I suppose you could also try specifying a line breaker. Something like: LINE_BREAKER = ([\r\n]+)(?\w+,) ... View more

grijhwani, I'm not familiar with the Nagios app, but often app developers will leave the index and input creation up to the user rather than assume to know what will work best for each environment. One customer may have all of their data in the main index. Another may split data into multiple indexes. As such, they don't specify indexes within saved searches or eventtypes. This makes them less efficient, but more likely to match a greater number of users. As for sourcetypes, what to name sourcetypes is usually subjective. If you aren't using the app, name it what you will, as long as the corresponding props.conf file references the correct name. Hope that helps! ... View more

I doubt if anyone is paying attention to this question anymore, but just in case: To disable iptables run: /etc/init.d/iptables stop and then run your tcpdump command again. You should see traffic coming in. If not, then there's probably some external firewall blocking traffic. If you do see traffic, then the host firewall (iptables) was the problem. You'll either need to configure it to allow the traffic through (Debian iptables document), or leave it off (document for update-rc.d). Hope that helps! ... View more

I can't answer this, but I can confirm that it's happening. Splunk 5.0.3, Google Maps app v1.1.3. ... View more

If you run a search for: index=* source="*Master.csv" Do you get any results back? I suspect that since you're seeing one event, Splunk indexed the file, but it probably saw it as one huge log entry. Also, how did you set up the input? Through the GUI? Did you specify a sourcetype? ... View more

Change KV_MODE = none to: KV_MODE = auto And Splunk should extract the field automatically. ... View more

Just add in an input stanza like this. [WinEventLog:customname] disabled = 0 index=windows ... View more

avitallange, I haven't done this before, but I'd guess that this would work. In transforms.conf [myextraction] SOURCE_KEY = MetaData:Source REGEX = E:\\Logs\\([^\\]+)\\([^\\]+)\\.*\.txt FORMAT = component::$1 instance::$2 And in props.conf [your_sourcetype_name] REPORT-myextraction = myextraction ... View more

I think you're going to have to go with a stanza per host that you're expecting traffic from. ... View more

the_wolverine, I don't think Splunk will accept CIDR notation (or a wildcard) in a tcp input stanza. The second option you listed should work though. Also, if you don't expect any other traffic on port 9999, you can also just do: [tcp//:9999] which will accept data from any host on port 9999. ... View more

Seems like something more suited to a bar or column chart. ... View more

Craig, You can certainly split up your props.conf into multiple versions, each geared towards an indexer or search head, but I'd suggest just copying the same props.conf over to both servers. You won't experience any performance hits, and it's probably less confusing in the long run. If you're dead set on splitting up your props, you can check out this link: here Hope this helps! ... View more

Clovens, Another possibility is that that beginning of line character may not actually be there. Try it with just Audit Success and see what happens. Also, the things that Ayn mentioned. Make sure those are correct first. ... View more

INEM, You don't have to install an app to receive syslog messages. Just enable the input. Check out this doc: http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Monitornetworkports ... View more

I'm going to have to go with Support on this one. If your retention time isn't terribly long, I'd just set the old server as a search peer of the new cluster. Once the indexes expire, decommission the old server. Otherwise, I'd go with their first suggestion and copy the indexes over. ... View more

heh... boobs... ... View more

hokie1999, One thing to note here. You edited your default inputs.conf. This is generally considered bad practice. If you were to update your universal forwarder to a newer version, the update process would revert your change back to, as the name implies, the default. Right at the top of the default/inputs.conf (as well as other default/*.conf files) there is a warning stating not to edit the file. You need to make this change in the local inputs.conf. In /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/, there should be a local directory. In it, there may or may not be a inputs.conf file. If there is, great, make your changes there. If there isn't, just copy the inputs.conf from the default directory into the local directory. Then make your changes to the inputs.conf in the local directory. ... View more

As Steve G. stated, there's no GUI for the Universal Forwarder. There is a GUI for the deployment server... sort of, but only a few of the features are supported in the GUI. If you're interested in using the deployment server, I'd recommend editing the files directly. The link you posted: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Extendedexampledeployseveralstandardforwarders is perfect. It shows you how to set up the deploymentclient.conf, the serverclass.conf, and the apps to deploy. ... View more

johnathan_cooper, I'd check to make sure your timestamps are being recognized properly by Splunk. If you do a RT search over all time and are seeing data coming in at different times (like you said, several hours in the past or in the future), then either your timestamps are wrong in the logs, or Splunk isn't recognizing the timestamps. I don't think it has anything to do with your indexers being overloaded or your queues being blocked. ... View more

jamiemfuse, And I cannot find any "useful" documentation. I'd recommend this page: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deploymentoverview First time I installed the universal forwarder I configured it to use the deployment server and gave server address and checked the standard 8089 port was listening on the server and that the client can reach it (they are on the same subnet). But netstat showed no comms between the two. The communication between a deployment client and a deployment server is not constant. By default, the deployment client will "phone home" to the deployment server once every 60 seconds to check for new content. It sounds like you may be confusing a deployment client/deployment server relationship and a forwarder/indexer relationship. They are two different things. A forwarder sends data to an indexer. A deployment client checks in with a deployment server and downloads new apps from it. Essentially a deployment server is a Splunk configuration management tool. In your case, since you're just trying out the software, you're probably not going to need to worry about a deployment server, but you can check out this link for the info on what a deployment server does: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutdeploymentserver I then realised that this port is not listening on the server - but I though the docs suggested that would be a default listening port at 9997? Check out this link on setting up a receiver: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver I understand that I may need to install the windows app on the server to allow correct indexing? This is incorrect, but it may be just in the way you're describing it. What are you looking to monitor on the Windows server? If, for example, you just want to monitor Windows event logs, then you just need to set up inputs on the forwarder that define those logs. Also, when you install a Universal forwarder on a Windows server, part of the setup process involves defining some inputs. You can specify Windows Event logs or other logs or directories at the time of setup. Ultimately it looks like your confusion stems mostly from what a deployment server does vs. what an indexer does. The links I provided should get you on the right track. ... View more

https://yoursplunkserver:8089/services/licenser/stacks ... View more