Hi, For replication factor 3 you need 3 peers, in this case if your peers goes down the replication factor is not meet until you add other indexer, but your search factor will be meet after the fix process. When your down peer goes up the master will rebuild the cluster make all the copies needed and yes after the rebuild all your peers will have a copy of the indexed data doesn't matter the time was down the indexer. Hope i help you ... View more

Hi, Forwarding from every HF will be the easy way to do it. http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd Hope i help you ... View more

Hi, I am using 2.1.1 version and it works. ... View more

Hi, Review the version that you are using? I had the same problem time ago. Hope i help you ... View more

Hi, You have to configure TZ in the forwarder, if you apply in the indexer it doesn't apply. Hope i help you ... View more

Hi, Sorry I didn't quote and the command was malformed The correct is : | rex "\s(?<days>[^\s]+)\sdy" |rex "\s(?<hours>[^\s]+)\shr" ....<-- continue with the rest of the fields |fillnull days hours .... value=0 | eval Totalsec = days*86400 + hours*3600 .... ... View more

Hi, Yes but with rex |rex field=Version "(?<1>.)(?<2>.)(?<3>....) | eval Version = 1.".".2.".".3 Hope i help you ... View more

Hi, Change the default admin password Hope i help you ... View more

Hi, You have the answer. http://docs.splunk.com/Documentation/Splunk/6.4.0/Forwarding/Compatibilitybetweenforwardersandindexers ... View more

Hi, Yes. I that case it will be | rex "\s(? [^\s]+)\sdy" |rex "\s(? [^\s]+)\shr" .... Hope i help you ... View more

Hi HeinzWasecher, Have you try to use separate extractions like: props.conf EXTRACT-dias = \s(?<days>[^\s]+)\sdy EXTRACT-horas = \s(?<hours>[^\s]+)\shr ... And in the search make a fillnull of all the fields and make an eval with the calculation |fillnull days hours .... value=0 | eval Totalsec = days*86400 + hours*3600 .... Hope i help you ... View more

Hi satishsdange, I recomend you to change this in your configuration root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat outputs.conf [tcpout:syslog_forward] server = 54.169.86.31:514 sendCookedData = false root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat transforms.conf [syslogTcpOut] REGEX = . DEST_KEY=_TCP_ROUTING FORMAT=syslog_forward Hope i help you. ... View more

Hi Julieda, What version of splunk are you using? ... View more

Hi, Just create a new app and copy from there. Hope i help you ... View more

Hi, What version of splunk are you using? ... View more

Hi, For use CIDR, first of all you have to configure the lookup with this kind of match http://docs.splunk.com/Documentation/Splunk/6.4.0/Admin/Transformsconf > match_type = <string> > * A comma and space-delimited list of <match_type>(<field_name>) > specification to allow for non-exact > matching > * The available match_type values are WILDCARD, CIDR, and EXACT. EXACT is > the default and does not need to be > specified. Only fields that should > use WILDCARD or CIDR matching should > be specified in this list After you do that, you can use your lookup as you want. Hope i help you ... View more

Hi, Reviewing the doc, the events are send to splunk via API, thats the reason that you have to configure the Chef application with the user,password and port 8089 of your splunk. Hope i help you. ... View more

Review this to probe. link text ... View more

Hi ctaf, The buffer of the UF are used only in TCP inputs, no for logs inputs. I am no sure that move the data in bucket level is the best way, maybe in the future buckets have the same id... I preffer to analyze the source and if all are logs that will exist during the time of the migration, I stoped all copy to the new servers, point all forwarders to the new and start the indexers. With this you will not have event loss. Hope i help you. ... View more

Hi, You can verify that the port is LISTEN netstat Hope i help you ... View more

Hi ctaf, If you stop the indexers, the UF will stop send events. When you start the indexers the UF will send from the point where was the UF when you stop the indexer IF the log still available for the UF, so you will not loss events. ... View more

Hi ctaf What kind of sources do you index, becouse if all the sources are log, maybe you can stop all the indexes, move to the new ones, point all the forwarders to the new indexers and start the new indexers. Hope i help you ... View more

Hi, Verify that the data input points to that index and is enable. Verify that the port can be open by splunk user, its mean that if splunk is running with not root user, all ports under 1024 are forbiden. Verify with telnet from the server that you can open a connection localyt to that port. Hope i help you ... View more