Thank you very much Mahamed. Linux FTW! Cheers! ... View more

Thank you so much Mahamed! Cheers! ... View more

Hi, this should get you in the right direction: ...|rex field=_raw "string1=(?<field1>\w+\d+)\|(?<field3>\w+\d+)\|(?<field5>\w+\d+)\|(?<field7>\w+\d+)\|(?<field9>\w+\d+)\|(?<field11>\w+\d+)\sstring2=(?<field2>\w+\d+)\|(?<field4>\w+\d+)\|(?<field6>\w+\d+)\|(?<field8>\w+\d+)\|(?<field10>\w+\d+)\|(?<field12>\w+\d+)$" | eval _raw=field1."=".field2.",".field3."=".field4.",".field5."=".field6.",".field7."=".field8.",".field9."=".field10.",".field11."=".field12 ... View more

Does devtools in IE, firebug, or dev tools in chrome show any errors on the consoles? Usually it will be something wrong with the permissions on the file, location of the file, etc. etc. If you're getting any errors while debugging in your favorite debug tools, please update your question with the errors. ... View more

Thanks for the follow up Mahamed. That's what I assumed the issue was. Here's a thought though, why did we deprecate search head pooling while not supporting search head clustering for windows? That effectively means we dont want users of the 6.2 windows version using clusters or pools. This is why I interpreted it as support coming very soon, probably works fine already. So I have about 3 months before I put this thing in production. Can you guess if the supported release will be available in less than 3 months? ... View more

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements The above document says Splunk does not currently support search head clustering on Windows systems. It also says: You must deploy at least as many members as either the replication factor or three, whichever is greater. But I have a replication factor of 2, and only 2 search heads. 3 is greater than 2 and is therefore the minimum according to the document. However, I'm up and running on a 2 search head, search head cluster right now in Windows 2008 R2 SP1 and it works flawlessly. I cant get the photo upload to work right now but I'm serious. Works fine. ... View more

PS C:\Program Files\Splunk\bin> .\splunk.exe show shcluster-status -auth admin:admin Captain: elected_captain : Fri Oct 31 17:19:06 2014 id : CF508875-4F9F-48BB-8CED-0766FA046729 initialized_flag : 1 label : WIN-DB5M3IDFOBE maintenance_mode : 0 mgmt_uri : https://172.31.16.105:8089 min_peers_joined_flag : 1 rolling_restart_flag : 0 service_ready_flag : 1 Members: WIN-DB5M3IDFOBE label : WIN-DB5M3IDFOBE mgmt_uri : https://172.31.16.105:8089 status : Up WIN-9FRI2MKI5GV label : WIN-9FRI2MKI5GV mgmt_uri : https://172.31.23.67:8089 status : Up ... View more

I just setup search head clustering in AWS with windows server 2008 r2. I havent setup a deployer yet, but searches are working and the shcluster status command looks good. I even did it with just 2 search heads instead of 3. (replication factor 2). I used this binary: splunk-6.2.0-237341-x64-release.msi ... View more

I would suggest that someone messed with the deployment server around this time and deployed the bogus changes??? ... View more

I feel that if you replicate the functionality of transaction you're effectively replicating its inefficiencies too. Logically, its counter productive. If you can provide better examples of your data and the exact outcome you're looking for, perhaps there is a better method than transaction. Until then, I remain confident in my original statement. You're reinventing the wheel to achieve the same functionality of the wheel, so why not use the wheel you already have? ... View more

You may also be interested in punct for this analysis sourcetype=foo host=Host1 | head 10 | table host, punct| append [search sourcetype=foo host=Host2 | head 10 | table host, punct] ... View more

gschmitz was correct, you can't tell him he's not because you didnt give him the correct requirements in your question. To limit the number of events per host use gschmitz answer but add a head. To do so will require two searches. Since we need two searches, we'll use the append command. With the append command, there will be no need to sort by host. sourcetype=foo host=Host1 | head 10 | table host, _raw | append [search sourcetype=foo host=Host2 | head 10 | table host, _raw ] ... View more

Just solved, thanks to your example. I changed my search to this: index="test" host="*P*" "Type=Error" | eval Code = if(EventCode="10034" AND match(Message,"InternalWriteEvent"),"Access Denied",if(EventCode="5749","Port Timeout",if(EventCode="5778","Failed to Process",if(EventCode="10033","Unexpected Message","Other")))) | top Code The example you gave wouldnt return "Other"s but did everything else correctly. The match(Message,"InternalWriteEvent") was key! Thanks! ... View more

I gave some examples of automating this process that you may find useful. They'll find the db_ and rb_ buckets in your archive path / backup path, and rebuild then place them in a thaweddb location of your choice. They don't check for bucket collision so you must manually scrub your buckets first. The scripts do not import hot buckets from the archive / backup. Hot buckets could be handled as follows: put them on a new splunk instance, roll them to cold, scrub the buckets, then run the scripts on the newly created cold buckets. ... View more

restor.ps1 - windows powershell users # This script will fsck archived/restore data and then put it into the index # It is designed for Splunk 4.1+, developed and tested on Splunk 6.1.2 # It is meant to be run as the SplunkD user # VERY IMPORTANT: HUGE ASSUMPTION # YOU HAVE ALREADY SCRUBBED YOUR BUCKETS!!! - # Bucket Scrubbing = Insuring that you will not restore any archived/backup buckets on top of their existing buckets within an index. (Making sure the old file names arent the same as exising files) # The buckets may be found in $INDEX_PATH\db, $INDEX_PATH\colddb, $INDEX_PATH\thaweddb, etc.. They have a name that starts with db_ and rb_, where db = normal copy & rb = replicated copy # YOU MUST SCRUB YOUR BUCKETS BEFORE YOU RUN THIS SCRIPT OR YOU MAY BECOME THE NEEDLE IN THE HAYSTACK $splunkExePath="c:\program files\splunk\bin\splunk.exe" #this is the path to splunk.exe $archiveBucketPath="c:\splunkbackups" #this is the path to your SCRUBBED restore/archive files (db_ & rb_) $restoreTemp="c:\temp" #this is the path to a temp location that splunk.exe will be able to access, it should have enough storage for all the buckets you'll restore $restoreToIndexPath="c:\splunk\index_name" #This is path the index you want to restore into. Most Splunkers recommend restoring into a new index if possible. The script assumes this exists. $restoreToIndexThawedPath="c:\splunk\index_name\thaweddb" #This is the path to the thaweddb folder in the index you're restoring too. # find the db_ buckets and process each of them $array=@(ls $archiveBucketPath| Where-Object {$_.Name -like "rb_*" -or $_.Name -like "db_*"} | select-object -expandproperty FullName) foreach ($bucketdir in $array) { $bucketname=$($bucketdir -replace ".*\\","") # make temp dir if (!$(test-path $restoreTemp)) { mkdir $restoreTemp } # copy bucket to temp dir if (!$(test-path $restoreTemp/$bucketname)) { copy-item $bucketdir $restoreTemp/$bucketname -Recurse #-WhatIf } # splunk(fsck) the index $splunkExePath rebuild "$restoreTemp\$bucketname" # move the fsck'd bucket into the thaweddb directory if (!$(test-path $restoreToIndexThawedPath\$bucketname)) { move $restoreTemp\$bucketname $restoreToIndexThawedPath\$bucketname #-WhatIf } # if meta.dirty doesnt exists create it if (!$(test-path $restoreToIndexPath\meta.dirty)) { New-Item $restoreToIndexPath\meta.dirty -type file #-WhatIf } # if processed directory doesnt exist create it if (!$(test-path $archiveBucketPath\processed\)) { mkdir $archiveBucketPath\processed } move $bucketdir $archiveBucketPath\processed\ #counter $x=$x+1 # give user chance to escape write-host "weve just completed $($x) of $($array.count)" # OPTIONAL: If you uncomment the below, this script will give you 15s to break operation after each bucket is processed. # echo You can break in the next 15s without losing any progress # sleep 15 echo proceeding } echo Total buckets restored: $x ... View more

restor.sh (for unix users) #!/bin/bash # This script will fsck archived/restore data and then put it into the index # It is designed for Splunk 4.1+, developed and tested on Splunk 6.1.2 # It is meant to be run as the SplunkD user # VERY IMPORTANT: HUGE ASSUMPTION # YOU HAVE ALREADY SCRUBBED YOUR BUCKETS!!! - # Bucket Scrubbing = Insuring that you will not restore any archived/backup buckets on top of their existing buckets within an index. (Making sure the old file names arent the same as exising files) # The buckets may be found in $INDEX_PATH\db, $INDEX_PATH\colddb, $INDEX_PATH\thaweddb, etc.. They have a name that starts with db_ and rb_, where db = normal copy & rb = replicated copy # YOU MUST SCRUB YOUR BUCKETS BEFORE YOU RUN THIS SCRIPT OR YOU MAY BECOME THE NEEDLE IN THE HAYSTACK splUser=splunk splunkBinPath=/opt/splunk/bin/splunk #this is the path to splunk binary / executable archiveBucketPath=/var/splunk/backups/index_name/db #this is the path to your SCRUBBED restore/archive files (db_ & rb_) restoreTemp=/var/splunk/index_name/temp #this is the path to a temp location that splunk will be able to access, it should have enough storage for all the buckets you'll restore restoreToIndexPath=/var/splunk/index_name/db #This is path the index you want to restore into. Most Splunkers recommend restoring into a new index if possible. The script assumes this exists. restoreToIndexThawedPath=/var/splunk/index_name/thaweddb #This is the path to the thaweddb folder in the index you're restoring too. # find the db_ buckets and process each of them for i in `find $archiveBucketPath -type d -name "db_*"`; do sourceBuckets+=($i);done for bucketdir in ${sourceBuckets[@]}; do let x=$x+1 bucketname=$(echo $bucketdir|sed "s/.*\///g") # make temp dir if [ ! -d $restoreTemp ]; then mkdir $restoreTemp;fi # copy bucket to temp dir & chown cp -r $bucketdir $restoreTemp/$bucketname chown -Rf $splUser:$splUser $restoreTemp/$bucketname # splunk(fsck) the index $splunkExePath rebuild $restoreTemp/$bucketname # move the fsck'd bucket into the thaweddb directory mv $restoreTemp/$bucketname $restoreToIndexThawedPath/$bucketname chown -Rf $splUser:$splUser $restoreToIndexThawedPath/$bucketname # if meta.dirty doesnt exists touch & chown it. if [ ! -f $restoreToIndexPath/meta.dirty ]; then touch $restoreToIndexPath/meta.dirty; chown $splUser:$splUser $restoreToIndexPath/meta.dirty; fi # if processed directory doesnt exist create it if [ ! -d $archiveBucketPath/processed/ ]; then mkdir $archiveBucketPath/processed/; fi mv $bucketdir $archiveBucketPath/processed/ # give user chance to escape echo weve just completed $x of ${#sourceBuckets[@]} # OPTIONAL: If you uncomment the below, this script will give you 15s to break operation after each bucket is processed. # echo You can break in the next 15s without losing any progress # sleep 15 echo ... proceeding done echo Total buckets restored: $x ... View more

There are permissions on the lookup as well. Not the file, but the lookup itself within Splunk. You can give it private, app level, or global. ... View more

Yes, please give examples of your header and footer. ... View more

Lets say the footer looks like this: # Hey, Im a footer # Use this in your props.conf: TRANSFORMS-null = sourcetype_NullQueue Use this in your transforms.conf: [sourcetype_NullQueue] REGEX=^#\sHey\,Im.a.footer.#$ DEST_KEY = queue FORMAT = nullQueue Then restart and test. ... View more

Permissions on the lookup could be the issue. I'm thinking you need to run this a couple of times though: |extract reload=T If that doesnt work, you can hit the REST API Endpoint (6.1.2 this exists, possibly earlier versions as well): curl -k -u adminuser:password https://localhost:8089/services/admin/lookup-table-files/_reload Make sure you put in an appropriate username/pass A restart of the search head should have done the above though... so check the permissions on the file as well as on the lookup. ... View more

updated, way to think outside the box and build upon my idea! ... View more

Can you do something in props or transforms to discard the events such as whitelisting or blacklisting? I'm assuming the events are the same in some manor. ie. EventCode=5000 ... View more

Are there any errors in your windows event logs? S(ystem, application, or security event logs) ... View more

See if this shows the multiple rest.py stanzas: /$SPLUNK_HOME$/bin/splunk btool inputs list|grep rest.py ... View more