Are you able to run any other r-scripts through the command? ... View more

I haven't done it myself directly, but I worked with someone that used the rest api to pull down various performance data (including quota) and writing it to a file which a monitor input was setup on. Maybe something along these lines? (doesn't have to be powershell) https://community.emc.com/community/products/isilon/blog/2013/09/25/using-powershell-with-the-papi-and-ran--the-basics I am guessing this outside of what the app is doing, but the best bet would be to identify what it is doing and hitting the docs (unless somebody can provide a better answer than this hah) ... View more

As pointed out in other comments/answers, using stats with the max function, or sorting descending with a head of 1 on the extracted field would give you the largest number for a given timerange. For the count of total events within a window, you could do something like: sourcetype=processing_job | stats count as "Total Events" for some given realtime window ... View more

Based on the shcluster/member/consensus endpoint you included in the question, it seems you have perused the REST API Reference : http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTREF/RESTknowledge Unfortunately there doesn't seem to be an endpoint to initiate a SHC deploy. The closest you could get would be to setup some other system to remotely call the command on the deployer through the CLI. ... View more

presuming that the first event's "Excecption" is a typo somehow, you could use that pattern to setup transforms to extract that field for this sourcetype EXTRACT-extract_ip = \sException:(?.*): You'd want to test this out to make sure it covers the sourcetype as you'd want, but this is the general process. ... View more

My take on this is that it might not be that Splunk work's better per se, but that it is better to setup smaller files through rotation by the fact that, since Splunk is indexing the contents of the files, you don't have to leave as much local on the system's disk. ... View more

is localhost.localdomain an entry in /etc/hosts? what do you get when you nslookup localhost.localdomain ? ... View more

A few things: Do you have any other clients that are able to checkin with the deployment server? Try setting the clientName = somedeployment.client.name setting in deploymentclient.conf I haven't seen this error before, but maybe check that the servername in etc/system/local/inputs and server.conf are resolvable ... View more

I don't know for sure if this matters, but is your transforms in the same app you are putting the script in? ... View more

Was that from the "Logging: Proven operational practices" section? I couldn't find a direct match for "Splunk works better with smaller log files" ... View more

For the JSON field extractions, I think INDEXED_EXTRACTIONS configuration in props.conf might lead you in the right path. The spec for props has more info here : http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf To convert from hex to decimal, you can use the tonumber eval function described here : http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions ... View more

It usually takes a few weeks for the slides and session recordings to be available online. I believe that you will receive an email notification, but I would check around a couple weeks into October just in case. The slides available through the mobile app might not be the final ones used in the presentation. ... View more

It's still ARM based right? Have you tried the instructions here?: http://blogs.splunk.com/2013/10/21/how-to-splunk-data-from-a-raspberry-pi-three-easy-steps/ Worse comes to worse, you could utilize syslog to send out to another machine with the universal forwarder. ... View more

Yes, but it depends on auditing the copy. You have to be able to capture the event from either the filesystem or database perspective, and then index that event in Splunk. Once you do so, you can create an alert that runs a search to find that event, and if it does it will take an action (send an email). ... View more

As alacercogitatus mentioned, you'll want to look at how the heavy-forwarders are connecting to the indexers (every forwarder has every indexer in outputs.conf, there isn't network connectivity issues, etc), but one other thing worth mentioning is that you might have a large amount of excess buckets on the indexers near capacity. These accumulate over time, especially if you are performing maintenance on the indexers, and depending on your rep/search factors. They can be removed periodically to free up space. See : http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Removeextrabucketcopies ... View more

I'd verify your universal forwarder configuration. For the windows event logs you are specifying in inputs.conf, you should have an "index=Index_test_03" configuration set. The main index is the default, and if you have events showing up there it means, for those inputs, they don't have any other index specified. ... View more

If you are concerned about Splunk performance the best thing to do would be to implement the Splunk on Splunk app, or Distributed Management Console. ... View more

What version of splunk? What version of the add-on? ... View more

first I would verify that you are indexing the Security Eventlog. [WinEventLog://Security] disabled = 1 Once you are sure that you are indexing the security eventlog, just search for "4672" on that sourcetype and see if anything comes up. ... View more

Check this link out and see if it helps : http://robpickering.com/2011/01/adobe-type-units-error-how-to-fix-it-343 ... View more

I haven't implemented the Stream app, but my guess is that you could use the deployment server to manage the forwarder config like any other app. ... View more

Ah, I left a bit out. You will need to add a couple more elements to the dropdown input: <fieldForLabel>CLASS</fieldForLabel> <fieldForValue>CLASS</fieldForValue> ... View more