sorry my mess - this would be Port 516 on the forwarder not indexer! But nevertheless the source device must be able to reach UDP Port 516 on your forwarder. Do you see any errors in splunkd.log on the forwarder regarding UDP inputs or the source? ... View more

Hi, is this new security device able to reach your indexer on UDP port 516? ... View more

Hi wood1986, have a look at the spath search command, its purpose is to have a straightforward means for extracting information from structured data formats like XML and JSON. hope this helps ... cheers, MuS ... View more

Hi rawatvineet, is there any special need why you want to install the Google maps App in Splunk 6? Splunk 6 comes with build-in maps and the Google Maps App is not released for Splunk 6. cheers, MuS ... View more

Hi manfrmuncle, THIS IS DANGER ZONE, FOLLOW THIS ON YOUR OWN RISK!!! You will loose all users and passwords!!! If you are really lost and Damien's answer didn't help, then here is a way to go: stop splunk - move your passwd file - start splunk this way you will get back default passwd file and therefore get back default password for user admin. So if you really want to do this and restore default password for admin proceed like this: $SPLUNK_HOME/bin/splunk stop mv $SPLUNK_HONE/etc/passwd $SPLUNK_HOME/etc/myOldPasswd $SPLUNK_HOME/bin/splunk start login as admin/changeme hope this helps and don't blame me if you lost all your users....I warned you before. cheers, MuS ... View more

I'm not talking about the already indexed syslog data. If you setup Splunk to receive syslog data and reboot / restart your Splunk server, who will then receive those syslog packets? Correct, no one will = data lost in UDP space....... To prevent such things you could setup a syslog-ng server as master syslog collector, save everything into a file and use a universal forwarder to read and sent this file to the indexer. hope this makes more sense now. Cheers , MuS ... View more

Hi cevyn, you found the place to change it. You can put log.cfg settings into a local file, log-local.cfg file, residing in the same directory as log.cfg . The settings in log-local.cfg take precedence. And unlike log.cfg , the log-local.cfg file doesn't get overwritten on upgrade. hope this helps ... cheers, MuS ... View more

Hi MHibbin try to step back to a more basic setup like in the docs and change it to match the examples. Try it with host::1* for example, instead of of source type. hope this helps ... cheers, MuS 🙂 ... View more

Hi Alex, Thanks for the fast answer. I think most of the Apps owner are not aware of this and maybe a little email note to them would help. cheers, MuS ... View more

Hi alacercogitatus, thanks for your feedback. It was indeed just a simple try to get an option to quiet out alerts for host with known problems. Data enrichment was not needed in this case, but could be added to the next release..... ... View more

This should be possible, but this is field extraction and is handled here in the docs http://docs.splunk.com/Documentation/Splunk/6.0/Data/Aboutindexedfieldextraction ... View more

I will just rephrase Ayn here: Sounds like you really need to take the basic Splunk tutorial. ... View more

more an advice then an answer, check out this answer on search scheduling http://answers.splunk.com/answers/33717/scheduled-searches-for-summary-index-does-not-run-no-skipped-log-in-schedulerlog ... View more

Hi Isaias.Garcia run the search you use on the dashboard manually and see what the result is. Also check the time range your dashboard is using for the search. hope this helps ... cheers, MuS ... View more

Hi docs.splunk.com and answers.splunk.com is a wunderful place to find all need to know about splunk, so here you go.... Hadoop DB connect hope this helps ... cheers, MuS ... View more

Hi 0range I use a summary saved search like this: index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity In the advanced XML dashboard I use a single value graph with rangemap like this: <module name="HiddenSearch" layoutPanel="panel_row1_col2" autoRun="True"> <param name="search"> index=summary search_name="YourSavedSearch" | table trigger_time ss_name severity | stats count | rangemap field=count low=0-0 elevated=1-1 default=severe</param> <module name="SingleValue" > <param name="beforeLabel">Overall Status: </param> <param name="afterLabel"> Alerts have been fired</param> <param name="linkFields">result</param> <param name="linkView">flashtimeline</param> <param name="linkSearch"> index=summary search_name="YourSavedSearch" | table trigger_time ss_name severity </param> </module> </module> hope this helps ... cheers, MuS ... View more