I would like to set up a splunk forwarder to listen for syslog connections (let's say on port 1514). I know specific source IP addresses which sends a specific sourcetype but for the other, I don't know. So I was thinkg of having an inputs.conf looking like this: [udp://1.2.3.4:1514] sourcetype = asm_log [udp://:1514] sourcetype = syslog But won't the two stanzas conflict ? If not, what will be the order of precedence between these 2 stanzas ? Is this order guaranteed to stay the same whatever stanza is in the other config files ? Can I invert the two stanzas and get the same results ? ... View more

I think everything is in the title 🙂 Extract from savedsearches.conf: [DB inspection] (...) search = | inputlookup monitored_indexes.csv| fields index | dedup index | map maxsearches=99 search=" | `db_inspect_collection($$index$$)`" I got an error with my splunk install base and traced it down to usage of "$$" in fire_brigade (something like "$unix_summary$ not found"). Why using "$$" ? ... View more

Hi, I would like to give access to indexing volume per day and per index to all my users but they must only be able to access to their own index + summarized index (to keep it simple, let's say userA has access only to indexA and summindexA). So I would like to do this by scheduling several summary searches (1 per user) taking data out of the _internal index and writing the results to users' summary indexes. A second search will take care of displaying the results. My saved search is the following: [Index thruput A] search = index=_internal source=*metrics.log group=per_index_thruput series = indexA | sitimechart span=1d sum(kb) by series cron_schedule = 15 * * * * action.summary_index = 1 enableSched = 1 dispatch.earliest_time = -1h@h dispatch.latest_time = now@h action.summary_index.name = summindexA I copy/paste this stanza and just replace "A" by "B" for userB, C for userC, D for userD, etc... The search displaying the results is: [Log volume (last 30 days) A] search = index=summindexA source="Index thruput A" | timechart span=1d sum(kb) as total_kb dispatch.earliest_time = -30d dispatch.latest_time = now I get some results but they are wrong: for some reason, the first search appears to ignore dispatch.earliest_time and is not only summing results from the past hour but from the whole day. Also I've noticed info_max_time is not present in the summary search results, meaning that checks for overlaps can probably not happen. Is it normal behavior of sitimechart ? (another sitimechart search appears to work the same way). Update My syntax for the latest_time was wrong: "now@h" was invalid and I should have used "@h". Not sure this is the root cause of all the problems but it certainly didn't help to get the results right. I've updated the saved search and will investigate again if I now get more accurate results. ... View more