You can find the various Data Models utilized by the CIM here : http://docs.splunk.com/Documentation/CIM/latest/User/Web The Web DM is in that link, but you can see the rest of them on the left hand side. It sounds like the Web DM might be what you're interested in, but let me know how it works out. ... View more

I think the first step would be to extract the fields in the data. i.e. host <service> Going from <initialstate> => <endstate> so in props.conf EXTRACT-bluepill = ^\S+\s(?<service>\S+)\sGoing\sfrom\s(?<initialstate>\S+)\s=>\s(?<endstate>\S+)$ Once you have the fields extracted you can build searches tracking the events that have those fields search (initialstate=up endstate=down) OR (initialsate=down endstate=starting) | eval end_host = endstate."-".host | timechart count by end_host Try out various searches utilizes those fields and let me know how it works out. Also, transaction might be worth checking out : http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Transaction ... View more

It seems that the Splunk syslog processor is mixing up part of the timestamp with the ip of the sending device in this case. I think that we'd need to see example _raw events for the correct and incorrect messages, but I think a better answer would be to switching to a syslog server for this data source. There are variety of drawbacks to using the network inputs. Check out this page for more info : http://www.georgestarcher.com/splunk-success-with-syslog/ ... View more

do you have a log sample, and the extractions you have tried so far? ... View more

Following the documentation is usually the safest bet. That being said, you'll probably be fine with a rolling upgrade. Just make sure you backup $SPLUNKHOME/etc before starting, and upgrade the Cluster Master first. Then upgrade a peer and wait to ensure that the cluster regains sanity. Seeing the first one play well will give you confidence to proceed with the rest of them. ... View more

Sounds like you might want to check out using rangemap with a single value panel : http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Rangemap#Using_rangemap_with_single_value_panels ... View more

are you saying the same scheduled search is running simultaneously on all search heads in the cluster? ... View more

Looks like a filesystem permissions issue. Make sure that that file exists, and that the user splunk is running as can read the file. ... View more

Hi lisaac, Based on the busyness of the hosts involved in the search, it seems reasonable that there could be momentary periods of high latency that could generate these messages. There are various timeout settings described in http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Distsearchconf that could adjust the environment's expectations, for instance: # this stanza controls the timing settings for connecting to a remote peer and # the send timeout [replicationSettings] connectionTimeout = 10 sendRcvTimeout = 60 ... View more

Although the preview functionality might be bugged, do you get any data once you've established the input? Can you run test queries against the database? ... View more

Hi chawagon, based on the log sample you provided, it looks like there is an issue with the CM being able to resolve it's hostname. Essentially, make sure that the entries in $SPLUNKHOME/etc/system/local/inputs.conf and server.conf are resolvable through DNS or /etc/hosts. Check out the answer here : https://answers.splunk.com/answers/312249/why-does-my-deployment-client-not-phone-home-with.html for more info, and let me know if that helps. ... View more

good old 4.1 ... View more

Hi jboike, you can use the Distributed Management Console to get an idea of resource usage on the instances in your Splunk Deployment. Disk utilization is one of these. Check this out and let me know if it helps : http://docs.splunk.com/Documentation/Splunk/6.2.6/Admin/ResourceusageInstance ... View more

Hi Brent, it's pretty straightforward. See the answer here : http://answers.splunk.com/answers/313100/how-do-i-delete-an-index.html#comment-312514 A link to the general doc is here : http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Remove_an_index_entirely ... View more

Hi brent_weaver, alert_actions.conf is indeed where the mailserver settings are. Here's the doc on it : http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Alertactionsconf Did you restart splunk after removing alert_actions.conf? Splunk will cache many config settings in memory. ... View more

What version of Splunk are you running? ... View more

I think your best bet would be to leverage the search console api : https://developers.google.com/webmaster-tools You'd have to write a script leverage the api to do what you want, and then either setup a scripted input, or write the results to a file and put monitor input on it. ... View more

I'm guessing the card reader is on the network? Does it have a REST api? I'd consult the documentation in that case, it's usually pretty easy to get started with the examples there and work up to extracting the information you want. As domenico_perre mentioned, if the reader has or interacts with some sort of database, you could possible utilize the DBX app in order to setup database inputs and ingest that data in splunk. : https://splunkbase.splunk.com/app/2686/ This sort of thing seems to fall under the "Internet of Things" umbrella talked about here : http://www.splunk.com/en_us/solutions/solution-areas/internet-of-things.html In particular, this software http://info.kepware.com/idf-for-splunk is supposed to be able to interface with Honeywell devices and inject the data out of the box. It costs some amount of money, but has a free demo. Let us know how it goes! ... View more