I should note that it is set with INDEXED_EXTRACTIONS = json so these values are all already extracted. I'd like to change them at search time. It looks like within the array the field values can have quotes or not and seems dependent on whether or not it is a string or number. ... View more

It doesn't appear this applies to v1.2.2 since that is a bit out of date but I do know in version of 2.x.x there are settings called "Max Rows to Retrieve" and "Fetch Size". I believe default for "Max Rows to Retrieve" is 10000 and "Fetch Size" is 300. Based on documentation there is a pretty good difference between 1.2.2 and 2.0.0. https://docs.splunk.com/Documentation/DBX/1.2.2/DeployDBX/Configuredatabasemonitoring https://docs.splunk.com/Documentation/DBX/2.0.0/DeployDBX/Createandmanagedatabaseoutputs Looking at 1.2.2 docs I am not seeing a setting in the inputs.conf file that would relate to those settings that are introduced in 2.0.0 making it appear it just attempts to grab all new entries from the latest value retrieved in the rising column. You could play with the cron interval the grab is scheduled to pull at to see if breaking it up into more manageable queries for DBConnect helps. I'm not sure the frequency setting it to "auto" would produce as it is dependent on volume. Looking at the inputs.conf for version 1.X the setting options seem to be severely limited. I'd recommend upgrading to a more current version if possible as 1.X is also end of life as of July, 2016. The are some optimizations that speed up these returns and more customization in later releases. It seems your DB may be producing events faster than DBConnect can keep up with at that version. ... View more

Where is the metadata file you are modifying for this? If the field extraction are contained within the app already but exported globally it would work to do: [] export = none This set the default for export within the app to be within the app context. One thing you will have to look for is if there are stanzas for each field in local.meta. In order to switch them to shared within the app you will either have to change export = none for each stanza, delete the stanza so it reverts to the default (careful if there are other local changes to the stanza), or remove local.meta so everything falls under default.meta (all local permissions changes would revert to those defined in default.meta). Think of it this way in the folder structure: Private Permissons - /opt/splunk/etc/user/user_name/app_name/metadata App Permissions - /opt/splunk/etc/app_name/metadata export = none Global Permissions - /opt/splunk/etc/app_name/metadata export = system Hope this helps. Let me know if you need further clarification. ... View more

I see you got it working. In regards to your edit, I'm afraid you will need configs on both your forwarder and search head to accomplish this. This doc might help figuring out which configurations go where: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F. The "INDEXED_EXTRACTIONS = json" can take place on the forwarder level. If you have a heavy forwarder instead of universal forwarder you can do the parsing components at the forwarder level as well though it is recommended to do that at the indexers unless there is a specific use case. Since the fields are set to be indexed at the forwarder/parsing level the "KV_MODE = none" and "AUTO_KV_JSON = false" should be set on the search head to say it does not need to perform search time extractions since the extractions already took place prior to that step. ... View more

If you are looking for total volume sent (including _internal) and not just license usage here is a good search: index=_internal sourcetype=splunkd group=tcpin_connections (connectionType=cooked OR connectionType=cookedSSL) fwdType=* guid=* | eval dest_uri = host.":".destPort | stats values(fwdType) as forwarder_type, latest(version) as version, values(arch) as arch, dc(dest_uri) as dest_count, values(os) as os, max(_time) as last_connected, sum(kb) as new_sum_kb, sparkline(avg(tcp_KBps), 1m) as avg_tcp_kbps_sparkline, avg(tcp_KBps) as avg_tcp_kbps, avg(tcp_eps) as avg_tcp_eps by guid, hostname | eval hostname = upper(hostname) This provides quite a bit of extra info. You can convert kb to GB as needed. ... View more

Duplicate "Client Name" or "Host Name"? Host name might occur if there was a previous installation of a Splunk Universal Forwarder on the system checking into the Deployment Server and it got reinstalled without reloading the deployment server. This would cause a duplicate since the new installation would have a different GUID. Client Name is defined in deploymentclient.conf under the attribute clientName. It's default is "deploymentClient'. It can be customized to your needs for filtering in Server Classes in Forwarder Management. It isn't necessarily a bad thing to have duplicate values for this and can be used to create forwarder groups to filter on. It could be possible you have an add-on deployed to multiple clients that has this defined as well. The best way to find where this is configured on each system is to run: splunk btool deploymentclient list --debug You can change the value as necessary. If it is still in default you'll want to create the file in local rather than changing in default. ... View more

Without downloading an app here is a search that should help: index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | eval host=h | bin _time span=1d | stats sum(b) as b by _time, host, indexname, sourcetypename | eval GB=(b/1024/1024/1024) | fields _time, indexname, sourcetypename, host, GB | stats sum(GB) as GB by indexname, sourcetypename, host | search indexname=* sourcetypename=* host=* You can use the last pipe to filter what you want to see. One thing to be aware of is host/source reporting can sometimes get squashed and you may see blank values for hosts/sources at that granularity. This thread explains squashing pretty well: https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html. There is a tunable setting in server.conf for this. ... View more

Yep, purely to test configurations. We have run into some issues while testing SSL from forwarder to indexer doing this however. ... View more

When setting up your search head cluster you can specify ports during configuration as well: ./splunk init shcluster-config -mgmt_uri https://:8x89 -replication_port 9x00 -secret shcluster You'll want a different management port for each one as well. ... View more

I'd start by making sure the forwarders are connecting to the indexers, not just the deployment server. index=_internal source=*metrics.log* tcpin_connections | stats count by sourceIp You should see connections from the forwarders and if they are connected you should also be able to search _internal for each host since they should be forwarding internal data. If they aren't connected I would check your outputs deployed to the forwarders. If they are connecting, just not sending the Windows data you are expecting I would check the monitor on the forwarder. On a forwarder you can run "./splunk list monitor" to see which files it is trying to monitor and forward. If what you are looking for isn't listed I'd check the deployment server for the app that defines the inputs and make sure the app is set to trigger a restart when updated. It could be possible the app was deployed but Splunk was not restarted and the forwarder has not yet loaded in the inputs. ... View more

In HEC configs, source/sourcetype settings come under the "per-token" settings: http://dev.splunk.com/view/event-collector/SP-CAAAE6Q. ... View more

You should be able to override source and define sourcetype for HEC during configuration I know for sure. I don't believe you can for host. You should also be able to override fields using props and transforms at the indexers. props.conf [<original sourcetype>] TRANSFORMS-force_host = force_host TRANSFORMS-force_source = force_source TRANSFORMS-force_sourcetype=force_sourcetype transforms.conf [force_host] DEST_KEY=MetaData:Host FORMAT = <your_host> [force_source] DEST_KEY=MetaData:Source FORMAT = <your_source> [force_sourcetype] DEST_KEY=MetaData:Sourcetype FORMAT = <your_sourcetype> The only thing I am unsure of is Splunk's order of operations. If it changes the sourcetype first, would it no longer see that sourcetype for the event and skip the host and source override? I would have to test but, if so, you should be able to just create a new stanza for the new sourcetype. https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Data/Advancedsourcetypeoverrides ... View more

I don't believe this is possible through search. If you are using a search to grab events those events have already been indexed. The nullqueue has to take place before indexing using props and transforms. props.conf [Vserver] TRANSFORMS-null = setnull Transforms.conf [setnull] REGEX = <your regex to capture events> DEST_KEY = queue FORMAT = nullQueue It would have to be a regex to filter the unwanted events which you should be able to create in a way that match that search query. Some examples of events to nullqueue and events to keep would help construct that regex. ... View more

When configuring your Inputs to ingest via DBConnect on the "Choose and Preview Table" section there is an "Input Type" setting. What you want to select might vary depending on the structure of your database. If there is a rising ID for each new event you can select Rising Column and it will keep a checkpoint value for what it has already seen. I believe the default it Batch Input which will just grab the entire table. There is also an Advanced option to try as well. ... View more

The way the regex works is it will capture everything between (). You can test by using something like https://regex101.com/. The capture group is setup with .* before username which means capture everything up to Username. Once it sees username it will continue to capture everything up until the next comma. So if all of your events are formatted the same as your original it should capture what you are looking for. There are probably better ways to create the capture group since I'm am not a regex expert. I'd welcome anyone else's input on the regex. ... View more

For getting license usage of a specific index I would recommend using the license_usage.log in the _internal index. Here is a recommended search: index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | stats sum(b) as b by _time, indexname, sourcetypename | eval GB=(b/1024/1024/1024) | fields _time, indexname, sourcetypename, GB | search indexname=* sourcetypename=* | stats sum(GB) You can change the filters to hit specific sourcetypes or indexes. You can add host/source metadata to the search but those values run the risk of being squashed in license_usage.log and may not be present in every event. The reason h or s may not be present in all events is described well here: https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html ... View more

This will periodically happen for host (h) or source (s) values. It is related to squashing of the values. A good answer of why this occurs is given here: https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html ... View more

Use props and transforms on the heavy forwarder. Props.conf [sourcetype/source/etc] TRANSFORM-trim_event = trim_event Transforms.conf [trim_event] DEST_KEY = _raw REGEX = (.*UserName: .+?), FORMAT = $1 You might have to adjust the regex based on your needs. I am not a regex wizard but base on your sample event that would capture what you want. ... View more

Your forwarders would be listed as the sourceHost field. Likely as an IP rather than a hostname. If you don't see the forwarders listed it would likely mean they are not reaching the indexers. ... View more

I'm not sure about getting rid of them in raw before indexing but if you are looking for search time field extractions without quotes I'd use props.conf and transforms.conf to achieve this. Props.conf [<sourcetype/spec>] REPORT-extract_quotes = extract_quotes Transforms.conf [extract_quotes] REGEX = [a-zA-Z0-9_]*"(.*?)" FORMAT = $1::$2 This should extract your fields to be without quotes when searching. ... View more