I use the command line for this... navigate to your Splunk install directory, then type "./bin/splunk list monitors" edit - Do this where you have the inputs.conf defined... assuming on your forwarder ... View more

Ah, it was getting eaten by the Splunk Answers gremlins 🙂 ... View more

Shouldn't the crcSalt have something on the other side of the "=" also? For instance, on my servers with extremely rapid log rolling I use "crcSalt = SOURCE" to help avoid missing/dropping files. ... View more

I agree with MuS, you can add the country_of_origin to your events at search time using an automatic lookup. It was a bit daunting at first to get a handle on how to set them up, but you'll get the hang of it and it'll be a great tool in your Splunk toolbelt. ... View more

I have been using the Splunk On Splunk app for finding problematic searches, etc.. and it's been working great. ... View more

I am using Splunk to do some of our application monitoring but not at that scale. I primarily alert when certain conditions are met in searching the log files (i.e. ORA errors, certain Java exceptions, etc...). I have been interested in using Splunk to gather OS metrics via the *nix & Windows apps, but don't have the license capacity to pull this off at the moment. Besides that we already have 4-5 other tools collecting OS metrics already. It would be nice to have that data along side app logs in order to try and find correlations (i.e. CPU goes to 100% while executing a particular java method). ... View more

You can't change what that host has already logged in the past. You would only be able to change what it is logging going forward by modifying the inputs.conf on that host. You can determine which source on that host is consuming the most with a search like this (sub in the hostname of the offender); index=_internal source=*license_usage.log h=yourhost | chart sum(b) as size by s | sort -size ... View more

I think you want the strftime() method of the eval command; strftime(X,Y) This function takes an epochtime value, X, as the first argument and renders it as a string using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". This example returns the hour and minute from the _time field: ... | eval n=strftime(_time, "%H:%M") Use the following to determine which pieces of _time to use for the date; http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Commontimeformatvariables It would appear %F would be what you need (i.e. | eval n=strftime(_time, "%F") ... View more

unfortunately no, clearing eventdata will only remove your data, not your license violations. The answer below seems to suggest you can backup your data, reinstall, then restore your data to unlock your license; http://answers.splunk.com/answers/68679/splunk-license-violation.html ... View more

you can search against your _internal index and find out which hosts (h) are using the most space using a search like this (searches are allowed against _internal even while searching is locked due to license violations). index=_internal source=*license_usage.log | where isnotnull(h) | chart sum(b) as size by h | sort -size ... View more

Can you post a sample of the event data? ... View more

I should add that you can see your license & pool settings by clicking on Settings in the upper right, then click on Licensing. There is a "Usage Report" button on the subsequent page that'll tell you how much you are using as well. ... View more

It looks like you are on the free license (524288000 bytes ~= 500 MB) and are exceeding 500 MB per day in data being sent to the index. The only way to avoid license problems is to reduce how much you are sending to your Splunk index. You would need to change some of your inputs (inputs.conf) to disable them or buy a larger license. The free license has a maximum of 3 violations in a rolling 30 day window where you will be locked out until those violations roll off (>30 days). I'd heard that you can completely uninstall/reinstall to get around being locked out of searching. Seems a bit drastic, but if your data is critical enough to warrant that, you could try it. ... View more

This would be a good place to start assuming you are running Splunk on the same system as you run IIS. http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/IISLogslocal ... View more

That's a big question. Could you be a bit more specific? If you are talking about monitoring your inbound usage (i.e. someone using your webserver), then you would add your IIS/Apache logs to Splunk using a universal forwarder preferably. If you are looking at outbound, then I'm not sure how you'd do that unless you could export your history to a log file somewhere and index that log file. ... View more

Did you add an automatic lookup called "dropdownsLookup" in a different app? Apparently even though you add a lookup in an app, other apps can see it if you define it by a common sourcetype. At least that is my experience at the moment. I asked a similar question recently. http://answers.splunk.com/answers/148810/why-other-apps-are-calling-a-lookup-that-is-not-globally-shared-and-causing-errors.html ... View more

this looks like a very simple transaction on the sessionid, if you don't want dst, then you could just throw a NOT in there; (your search params) dst!=* | transaction sessionid ... View more

example search for auth changes in Splunk; index=_internal host= method=POST "authentication" It picked up the creation, group change, and password change events for the user I just tried out. ... View more

I did create it by a source, but I did so within the app. If that's the way it really works, then this sounds like a bug to me. I thought the app was the way to corral things together that belonged together. I guess I could look to try using host instead of source, but that's gonna get ugly methinks. Many of our hostnames are the same except for a number. ... View more

Agreed, I just created my entire lookup (table, definition, and automatic lookup) in the app I want it in and it isn't showing the automatic lookup. Did you ever find an answer for this? ... View more

I'm having the same problem, I'm curious if you ever got this resolved and could post the fix. ... View more

I believe there's a max match option for rex... forget the exact syntax (max_match=3 perhaps?), but that might work. ... View more

the (?P \w*) piece is Splunk's language for extracting a field. You won't be able to test in rubular. So what you're saying is that the literal string "F:\mssql\backups\..." is in the event data itself? in that case, just drop the "field=source" and it'll extract from the _raw. ... View more