To add to Luke's answer, this script and lookup mechanism is described in the Splunk documentation ... View more

ancient answer to ancient question now accepted! thanks! ... View more

You can get a feel for it by indexing a subset of /var/log, or taking advantage of its general analysis capabilities by indexing a specific application log. Take a look at this list of apps. Splunk lets you find a needle in a haystack, but it also does a lot of good when just trying to view data from different angles. ... View more

You can try to script out something to get the results you want, without using wmi. Or, figure out why wmi isn't working. 0_o ... View more

The answer, as far as I have been able to determine, is that you cannot un-drill down in splunk web. The workaround is to modify the search string, erasing what was put there by the initial drilldown. This isn't as nice as a back button, or some similar mechanism (hotkey?) to move backwards. ... View more

If remote wmi is an issue, maybe you could try saving the results of wmi query locally on the win2k box, and then have something on win2k3 box that reads the file, saves it, and then indexes it. Seems a little hacky I guess, but the basic point is try to avoid using wmi. ... View more

Here are a couple searches that will get a list of hosts. This one will give you all machines in last 10 minutes reporting in: * minutesago=10 | dedup host | stats list(host) you can run this over any time frame you want... minutesago=30? Or, you can use the time picker and select "custom time" to look at all host reporting in during the time frame of your choice. Here is another search that gives you all hosts reporting in, but also the number of events from each host: * minutesago=10 | chart count(host) by host The above search will give you each host reporting in during last 10 minutes, and also the number of events from that host. Lets you see who is most active. ... View more

I plan on looking at this again in the near future. For the record, I haven't been able to get a workable solution, but intend to. ... View more

ah... thats it. So the variable is all the values of a field in the collection of events that you pipe to map. ... View more

Did you run this? I tried with 3 hosts and it seems to report something. {CODE}| metadata type=hosts | map maxsearches=3 search="search host=$host$ minutesago=1" {CODE} produced some results--without a histogram-- and when I tried 15 hosts splunkd crashed hah ... View more

this works for one host-filesystem pair but falls apart when the search contains results from many different filesystems/hosts. Is there anyway to account for that besides limiting the search to one host/filesystem? ... View more

You can use $SPLUNK_HOME/bin/splunk list monitor for a list of all things that splunk is currently monitoring. Check http://www.splunk.com/base/Documentation/latest/Admin/CLIadmincommands for reference on this. ... View more

You could monitor such a file by using a wildcard for the variable part of the file. I.E. [monitor://<path>/daily_file*] Presuming that the "daily_file" part is static, and what comes after that is the datestamp. ... View more

now that I think on it I believe it is a lightweight forwarder. So I can't filter out specific events before they get sent across? How could I configure the indexer to filter a specific eventtype from a specific host? ... View more