Hello, Can someone please clarify the intended use for the various parameters for the type field under the Alerts data model? e.g. alarm, alert, event, task, unknown ... View more

Does anyone have a data curation search that I snag? Looking for logs and values which are not currently done in key values. ... View more

Splunk 6.3 I am looking at the feature host_segment=x in inputs.conf. And wondering if there is a similar feature for source type? For example, I have a directory of logs on the network for a series of servers that look like this /NFS/mounts/Servername/sourcetype/thefiles.txt I'd like to just set this, but that doesn't seem to work. Any trick to this? Or work around? [monitor:////nfs/mounts/*/*/*] host_segment=3 sourcetype_segment=4 disable=0 ... View more

We have a common field in our log to track user activity which we currently call "dye". We're in the process of changing this at this time. So I can name it what ever I want. Skimming CIM docs I don't see anything that jumps out at me. Anyone in the know with CIM, have a recommendation for me? I feel like there should be a CIM field for sessionID or userjavasession or something like that. Any recommendations? ... View more

hello, I initially built my search head cluster with 8 core VMS x10. Things are working great. 5 in our primary data center, 5 in our DR data center. I'm considering moving to hardware and was curious if I can have mixed core counts since only the primary side of my environment can have hardware, our DR site MUST remain on VMS. That is, can I have a few 24 core blade on this side. And 12 VMs on the other side? Will Splunk be able to balance the saved search/reports/summaries/accelerations? I'm not worried about users side, since I can configure that at the F5 load balancer relatively easy. ... View more

Hello, I added a transform/props for my Juniper SRX firewall logs to get sourcetyped as juniper_sa. Worked right out of the gate. BUT when I search by that source type I get no results. How ever clear as day I can see that source type on the logs Another way of saying it is this: as search of "index=firewall" returns events which clear as day have source type "juniper_sa" on them a search of "index=firewall sourcetype=juniper_sa" returns no results. I tried adding the transforms/props to my search head as well as intermediate servers. Didn't seem to matter. Same problem. Any ideas? ... View more

Our Splunk install is fast closing in on 4 years old. Predating me for a good 2-3 years of use. Its got near 400 dashboards and I have no idea which ones are used and which ones are not. Any idea on how I can get a "number of time this view was loaded in X days" and"last time loaded" meta data about a view/savedsearch etc? ... View more

hello, Splunk 6.13/CentOS 6.4 I recently had a Splunk outage. My monitoring software showed, plenty of IO, CPU and RAM available. Yet forwarders were reporting the TCP queues were full on the receiving indexers. I popped into Splunk on Splunk and looking at my fill Ratios all 4 stages, which are normally 0. The 4th indexing queue was maxed. We actually had lower than average throughput. After some poking around I discovered a set of Real time dashboards were created by our NOC and send out to the general population. Once I disabled RT the queues went right back to 0%. The abusive RT dashboard aside. I feel there is some performance tuning I am missing. With plenty of system resources available I'd like to undertand why these queues backed up so bad and what I can do get the indexing queue better performance... ideally without installing 10 more indexers 🙂 ... View more

hello, Is setting up Bloom Filters still recommended under 6.23? I am hearing conflicting statements about if they should still be setup and if they actually drive value. ... View more

Goal - Change the default time of search to 15 minutes in all apps. I created a ui-prefs.conf in the local of the search app, but this didn't work. I also tried in the local of the system and didn't work. I believe this should set my default time in search to 15 minutes, but with no luck at all. [search] dispatch.earliest_time = -15m@m dispatch.latest_time = now ... View more

Hello, Is there a way to launch a script on the Universal Forwarder's App's bin directory from the search head? For example: Scheduled search index=java *oom* host=mybadjbossserver Causes: mybadjbossserver's universal forwarder to call /opt/splunkforwarders/etc/apps/myjobsapps/bin/fixjboss.sh to run Right now I have scripted inputs that have scripts that check the condition via bash, which isn't good. I suppose I could use wget to make an API call to a search head and act on results, but I feel like I would be running the same script twice (one for the notification and one for the action) and I am not really confident in my ability to produce a good API call. ... View more

All, I was hoping to build a few alerts based on the information that I see in the Activity >> Jobs dashboard in Splunk 6.2.2. A couple simple things 1) Alert when there are 50+ jobs running 2) alert if a job is running more than an hour 3) See searches per hour by user Any example searches of app you can recommend to get me started? ... View more

I have basic input for udp://514 with index=network setup as the default index. We started taking syslog traffic from ESXi though. I'd like anything that comes in with the hostname of host=*vmware* to go to the index=vmware . I am drawing a blank on this. Any help ? ... View more

Hello, We are currently establishing a foothold in Europe and retention of logs can very greatly I am told. Does anyone have a good ref document for this to begin my conversation with our legal team? Or a template I can work with to get started? thanks in advance, -Daniel ... View more

Hello, Our naming convention has a relatively strict set of rules on it. e.g. datacenter+envionmentnumber+securityzone+role+increment. NY0099HTTPD001 Right now, I find myself add an extraction in EVERY source type I do to break that up as key value pairs for users. Is there a way to do this globally? ... View more

Hello, Is there a way to get a RSS or email notification when a new notable suppression is created or enabled in ES? ... View more

Hello, Where can I find the searches that power the Forwarder Management console? I am looking to export and alert on failed hosts or partially deployed hosts. thanks! -Daniel ... View more