Youll want to use these in inputs.conf: _SYSLOG_ROUTING = primarySyslogs _TCP_ROUTING = somethingThatDoesntExistInOutputsConf And then you'll have something like this in your outputs.conf: [syslog] defaultGroup=primarySyslogs [syslog:primarySyslogs] server = 10.1.1.197:514 https://answers.splunk.com/answers/54086/inputs-conf-syslog-routing-only.html Your configuration may need to vary slightly. Perhaps you want specific events sent to syslog, others indexed, etc. I recommend that you read the docs very carefully and test before implementing in production if possible: http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Outputsconf http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Inputsconf If you need to parse out specific events for syslog and index others,... you'll need to look into transforms.conf and props.conf as well ... View more

It sounds like you dont need a python script and instead you should check out the inputs.conf directive known as "monitor": http://docs.splunk.com/Documentation/Splunk/6.3.1/Data/Monitorfilesanddirectorieswithinputs.conf http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Inputsconf #<-- search for word "monitor" Examples: The following configuration directs Splunk to read all the files in the directory /var/log. It reads them infinitely... as in any new files are automatically read. [monitor:///var/log] The following configuration directs Splunk to read all data in one file within /var/log. Any changes appended to the file are automatically indexed. [monitor:///var/log/filename] ... View more

How about this?: (index=network sourcetype=analysisFiles file_accessed="zip") OR (index=analysisFilesUserAccess) | stats count by srcip, user, hostname, data ... View more

You should use the job inspector and look at search.log, etc. to see what error if any are occurring. Hopefully there is something and you can post that here. umm... sorry i guess there isnt a job inspector on dashboard 🙂 How about index=_internal log_level=ERROR OR log_level=WARN? ... View more

If you use a program like Fidler, you can open fidler, then go to the part in splunk web ui that has the "rebuild acceleration" link, start fidler's capture, click the link... stop the capture. Then read through the web requests in fidler to figure out how the webui does it. Then mimic that behavior. Please mare dturnbull's response as the answer to your question, because it is, and if you find my reply about your rebuild issue acceptable, upvote my comment to spread the love. Cheers! I assume it does 2 posts... one to disable the current acceleration, and then another to enable it again. http://docs.splunk.com/Documentation/Splunk/6.0.5/RESTAPI/RESTknowledge#POST_datamodel.2Fmodel ... View more

Yeah that's it because they said its 400GB on each indexer. Hence why I asked what the site replication factor is. @amandhscareer, lets say your 3 indexers each have a unique copy of 1 bucket. Your DR indexer will get a copy of each bucket, making 3 buckets total. See this document as there is also a site_search_factor you should consider as well. http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Multisitearchitecture ... View more

What is your site_replication_factor? ... View more

Or this: index=XXXX sourcetype="XXXXXX" type=ERROR errorType="*" OR errorType2="*" OR NPE="*" | rename errorType2 AS errorType NPE AS errorType | stats count by errorType | rename errorType AS "Name of Error" ... View more

Here's how to specifically add an indexer to a pool: http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Addanindexertoalicensepool ... View more

Start here: http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Manageyourlicenses Make sure you read this subsection thereof: http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Groups,stacks,pools,andotherterminology A license pool is made up of a single license master and zero or more license slave instances of Splunk configured to use licensing volume from a set license or license stack. In short, when you configure licensing on the Splunk instances you specify which license server to use, and then create the pools. So if you setup indexer 1 and point it to license master 1, then it will use the licenses provided by that license master. ... View more

I'd raise a support request or check for help in the irc channel if it's customer affecting. ... View more

The original question of can we have linux forwarders sending data to windows indexers: That perfectly acceptable and 100% supported. That's the question I originally answered. Ive since edited further although im pretty sure I had the correct answer. Then you asked how to migrate from windows to linux for example, and I was able to show you that a windows search head works fine on a linux cluster but it's not documented to and therefore is unsupported. As for documentation on what will happen if you have A B or C config... will B on linux lose XYZ capabilities... as far as I know there isnt much documentation on this. I can tell you that only windows splunk servers can monitor powershell, Active Directory, and WMI inputs. If you still believe I haven't answered your question, file a case for "the word" from splunk 😉 then you'll have it all official and what not. FWIW, I for one believe I've gone above and beyond, I even spent money to prove to you that it works with screenshots. Maybe you can give my comments some karma for the attempt to help... ? 😉 ... View more

In both examples, i've used the Linux deployment server "jindexmaster" to deploy a forwarding application to both windows machines. So again this can be done contrary to the documents. However, it is not supported. ... View more

Here is a windows peer node joined to a linux cluster: ... View more

This is a windows search head joined to a linux cluster... ... View more

This is a windows search head joined to a linux cluster... ... View more

I see you voted on my answer @gavsdavs_GR. If this answered your question can you please "mark as answer" for us as well? Thank in advance, JKat54 ... View more

Splunk is 100% compatible but ???NOT SUPPORTED??? from linux -> windows and windows -> linux. As long as all the indexers/peers are the same OS, which is mentioned here: http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Systemrequirements ... View more

I think this will fix it: <nav color="#778899"> <view name="my_dashboard" default='true' > <saved name="My Saved Search" /> </view> <view name="search"> <saved name="My Saved Search" /> </view> <view name="dashboards" > <saved name="My Saved Search" /> </view> </nav> Or some combo thereof. I hope you can see/understand the difference in my XML vs yours and then solve accordingly. Well that and I hope it solves the problem and I don't look silly trying to help!!! ... View more

before, was it one out of every six that didnt linebreak correctly, or is the behavior better now? If the behavior is better with the props i suggested then we're at least moving in the right direction. Next I would make sure props are on all indexers and forwarders. If the behavior is the same, then its back to the drawing board... I'd like to see the script that generates the data. ... View more

so what was the solution here? And where does the nest app come into play? ... View more

This error means your mail server will not allow you to send mail as the email address you're using. Often times you'll have to create this user / email address. I'm talking about splunk@printlaser.com ... View more

Can you post an example of the data? ... View more

I think it has to do with how the fishbucket is architected. I have no doubt it could be modified for this specific case but not recommended due to other reasons. ... View more