Our co. has been gathering auditd logs since last summer now our Splunk infrastructure is getting very fat on the indexed auditd data. I cant delete this data either since we require it for audits. The solution i was coming up with was to start summarizing the _raw data from some other previous examples i've seen index=audit | dedup _raw | rename _raw as orig_raw Then verifying the summarized results vs indexed results and expiring data off colddb sooner then it is now. Is there a better solution out there? the main goal is to reduce index disk usage. ... View more

in my cluster i've setup the master and search peers and have the neccessary "master-apps" and "slave-apps" directories setup. I've got the custom indexes.conf in $SPLUNK_HOME/etc/master-apps/base/local/indexes.conf the bundle pushes correctly and and on the peers its correctly going to $SPLUNK_HOME/etc/slave-apps/base/local/indexes.conf When i add the search head to the cluster, it's not able to see these indexes. on the master dashboard it also only shows the basic default indexes and not the ones getting pushed in the bundle. Do i need to manually add the indexes my bundle creates or should i do something else to get the master and search head to recognize each index? ... View more

I am in the process of setting up my Splunk 6.0.2 cluster here and when connecting to the master node it appears the search peer is using my default IP of my eth0 interface. These search peers have multiple ips, including a bonded virtual ip for redundancy. How can i specify a bonded virtual IP to be used as the search peer name/address? would i have to make changes to the local routing table or can i just specify the IP in Splunk? I dont see an option to make changes in the master or from the search peer when i add it to the cluster ... View more

Hi, I was working with installing SplunkIT on a host here with Splunk installed, but the system has python 2.4.3 Instead i tried to point SplunkIT to the 2.7.x version of python included with Splunk but received errors about missing modules first the uuid module -bash-3.2$ /ngs/app/splunkt/splunk/bin/python bin/gendata.py Traceback (most recent call last): File "bin/gendata.py", line 20, in <module> from pyro_server import * File "/ngs/app/splunkt/splunk/splunkit/splunkit-server/lib/pyro_server.py", line 17, in <module> import Pyro4 File "/ngs/app/splunkt/splunk/splunkit/splunkit-server/lib/Pyro4/__init__.py", line 67, in <module> from Pyro4.core import URI, Proxy, Daemon, callback, batch, async, Future File "/ngs/app/splunkt/splunk/splunkit/splunkit-server/lib/Pyro4/core.py", line 9, in <module> import logging, uuid ImportError: No module named uuid then after i copied over a working uuid module into the splunk dir, it complained about others. It appears we cannot use the pre-installed 2.7.3 splunk version included with Splunk installations in conjunction with SplunkIT? ... View more