All, I am currently playing with some line breaking. But in order to test it I need to update my crcSalt, and restart Splunk. A little time consuming. Is there a faster way of doing this I am unaware of? ... View more

All, I have about 2658 devices checking into our deployment server (CentOS 6.6, x64, Splunk 6.41) 8vCPU/16gigs ram Over all we sit around 10-20% CPU with plenty of memory free. But the over all UI performance is becoming basically un-usable. I am guessing there are some performance tweaks I need to make. Really havn't seen any guides to this. Probably worth mentioning 99% of the clients have a 2 hour check-in time. But about 20 servers (other Splunk servers) are set to every 2 minutes. top - 19:09:45 up 319 days, 1:44, 2 users, load average: 0.72, 0.63, 0.40 Tasks: 235 total, 2 running, 233 sleeping, 0 stopped, 0 zombie Cpu(s): 20.9%us, 7.8%sy, 0.0%ni, 69.0%id, 1.7%wa, 0.0%hi, 0.4%si, 0.0%st Mem: 16333660k total, 15423556k used, 910104k free, 191868k buffers Swap: 8388604k total, 375048k used, 8013556k free, 8733040k cached ... View more

All, I created an app using the AppBuilder today and when I attempt to upload the app to Splunkbase, I get this error "*.pyo/*.pyc files are not allowed" . I didn't create those files, they are created by Splunk itself. I am temped to just deleted them and "See" if my app works. Any idea what those files are? If I need them and why AppBuilder added them to my app? ... View more

All, Can you do a quick peer review of my index config here? My expectation is we can save as much as we want, but once we go over 1/2TB, older buckets will get dropped. Indexing, however, will never stop, giving my user 1/2TB to use how he pleases. [volume:akamaidisk] path = /akamaidata maxVolumeDataSizeMB = 500000 [akamai2] homePath=volume:akamaidisk/akamai2/db coldPath=volume:akamaidisk/akamai2/colddb thawedPath=$SPLUNK_DB/akamai2/thaweddb maxDataSize=auto_high_volume ... View more

All, We have legacy servers going years back and newer ones etc. Basically, we have ended up with about 30 different settings in httpd.conf for logging. They asked me what I want the standard to be for Splunk reasons. Started to think about that, and is there any reason why I shouldn't directly ask for CIM friendly key value pairs rights now in the source? LogFormat %t src_ip=%h RemoteLogName=%l RemoteUser=%u request=\"%r\" %>s %b \"%{Referer}i\" http_user_agent=\"%{User-Agent}i\" Example: [17/Aug/2016:20:20:27 -0400] src_ip=192.168.1.47 RemoteLogName=- RemoteUser=- request="GET /default.html HTTP/1.1" 304 - "-" http_user_agent="Mozilla/5.0 (Macintosh; Inte.... ... View more

All, I am unable to search by a mvexpand which I am doing via fields.conf. I am getting the extraction I expect, but searching by that fails. This search fails, but is based on clicking right in the GUI - index=main PCIDSS="11.1.2.a" Reference back to the original post - https://answers.splunk.com/answers/440752/how-do-i-automatically-run-mvexpand-on-a-field.html ... View more

All, We have a report that runs every hour. Basically 10 line CSV. Might grow to 20 lines on an off week. myreport-%date%.csv It's populating a larger data set. 99% of the time the report will be identical the previous run how ever. Since it's only a few kilobytes in size I would just rather Splunk ingest the report every time. But I believe there is some mechanism in Splunk the prevents it from reading in a file identical to another file in the same directory. Anyway to disable this? I tried crcSalt= and it only worked for one run. ... View more

All, So I am playing with the netstat feature in Splunk for Unix. There does not seem to be field extractions for the columns in Netstat. Output look something like this from the netstat.sh command Proto Recv-Q Send-Q LocalAddress ForeignAddress State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:49085 0.0.0.0:* LISTEN Any idea where I could start with this? ... View more

All, So there are situations where folks ask me to "check the logs on everything on subnet 1.2.3.x/25" Rather than by host. Especially with PCI. Is there a meta data relationship stored in Splunk from the UF and the host name? What about syslog devices? thanks in advance, -Daniel ... View more

All, I am looking at Splunk for Unix TA. I see the /var/log/messages input and for the life of me I can't find in this app where it's getting it's sourcetype of "syslog". Skimmed props.conf on the TA (why does the TA have a props?) and the splunk_for_unix_app too. [monitor:///var/log] whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out) blacklist=(lastlog|anaconda\.syslog) index=os disabled = 1 ... View more

All, Has anyone done any hardware benchmarking with splunk and these m2 interface disks? http://www.tomshardware.com/reviews/kingston-hyperx-predator-480gb-m2-pcie-ssd,4113.html#p4 Seems like they would be pretty performant in a cluster. ... View more

All, I found myself writing this props.conf today. Say I have this: [tomcat:src:server] EXTRACT-springapp_name = /var/log/containerlogs/(?.+)/\d in source EXTRACT-containerid = /var/log/containerlogs/.+/(?.+)/ in source [tomcat:src:access] EXTRACT-springapp_name = /var/log/containerlogs/(?.+)/\d in source EXTRACT-containerid = /var/log/containerlogs/.+/(?.+)/ in source I could I just do this? [tomcat:src:*] EXTRACT-springapp_name = /var/log/containerlogs/(?.+)/\d in source EXTRACT-containerid = /var/log/containerlogs/.+/(?.+)/ in source ... View more

All, We are currently getting a log like this from our F5. xff="1.2.3.4, 4.3.2.1, 4.2.2.2, 9.8.7.1" I'd like to mvexpand it. I assumed I could just |mvexpand xff , but that doesn't not work. Any idea how I would tackle this? ... View more

All, So I have a lookup, of say 10,000 items. I'd like to merge it all as one giant event for a specifical visualization I am working on. thanks -Daniel ... View more