Anyone every resolve this?? I have the same problem. ... View more

I would first decide on what I think would be acceptable for search times.. Then use job inspector to see what is the most taxing part of my search, modify the search accordingly (although it looks like you may have done that?) Depending on the type of search you are running it will also change whether the search is CPU bound or I/O. With regards to summary indexing it depends on how long a period of time you generally plan on reporting over? Check this link out for more info on report acceleration vs SI: https://answers.splunk.com/answers/135451/summary-index-vs-report-acceleration.html ... View more

Have you checked the permissions on the lookup files in question? ... View more

You can use btprobe for a specific file: https://answers.splunk.com/answers/54147/how-can-i-trigger-the-re-indexing-of-a-single-file.html ... View more

If you are using the search app just copy whatever files you update into the search app folder on the deployer, alternatively you can create your own app and do that too. ... View more

You are doing a batch upload - that will destructively upload the file once(delete it from disk after upload)..so that same file shouldnt be there in which case you wouldnt need crcSalt as there is nothing to reingest? Are you using batch because the files are too big for a file monitor? Another option to try would be to clean the fishbucket or you could just oneshot the data in again.. here is a link to a few other things you could try: https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html ... View more

Are other users experiencing the same problem or just you? It could be ssl related. Are you running in a distributed environment, can you log in to other servers? I can see you have a few conf errors as well - this link should help you fix those old values for the conf files: https://answers.splunk.com/answers/548915/after-a-successful-upgrade-from-621-to-661-we-are.html ... View more

Is https still being used after the upgrade? Try http - it could have reset or not loading conf files properly. Or is this message only occurring when trying to load a certain page? ... View more

You could accept the main initial answer - would sitll guide people here.. there should be an "accept as answer" option ... View more

Are you running in a Search head cluster? Are you sure your user account has permissions to create alerts? ... View more

Haha no worries man !.. Dunno why my comments are disappearing! ... View more

You should make changes in the local folder, just in case someone comes along and creates a stanza for the same sourcetype and overwrites your settings in default(it wont fix your problem but is a best practice). Regarding you inputs it looks fine - but there is clearly a lag in indexing.. Can your environment handle the amount of data that is flowing into your indexers from wineventlog? This article has a few tricks you can try: https://docs.splunk.com/Documentation/Splunk/6.6.3/Troubleshooting/Troubleshootingeventsindexingdelay ... View more

Can you send a snip of your input stanza for the security logs in wineventlog ? ... View more

This doc will probably help you http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad ... View more

Hi, You specify the sourcetype at input time(it will be more efficient) in inputs.conf.. So you would have your monitor stanza [monitor this file] under that you put sourcetype = mysourcetype. http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Data/Monitorfilesanddirectorieswithinputs.conf There is no need for regex unless you are trying to extract multiple sourcetypes from a single log or something like that ... View more

The search head cluster will replicate certain runtime changes by default(if you edit the lookup in the gui or if done by CLI and REST). Otherwise if you edit a lookup or static config file, put it on the deployer and then push the changes to all SHC members as normal. See here for reference: http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/HowconfrepoworksinSHC ... View more

Use this search to verify the source type, the time stamp detected (_time), the time of the user on the search head (now), and the time zone applied (date_zone) source=mysource host=myhost | eval delay_sec=_indextime-_time | convert ctime(_indextime) AS indextime | eval now=now() | table _time indextime now date_zone source sourcetype host ... View more

Check if there is some kind of indexing lag in your environment - source=mysource | eval delay_sec=_indextime-_time | timechart min(delay_sec) avg(delay_sec) max(delay_sec) by host Alternatively - has that DC host been set a timezone in another app? Can you run a btool to check that? ... View more

Can you send me an example of the search you are running and a snip of the results? ... View more

What happens if you dont apply a TZ ? What time are you getting for your sourcetype then? ... View more

Sure am: http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Propsconf --search for "The following example sets Eastern Time Zone" ... View more