Hello Splunk Expert, The situation: I have a logs file around 10 MB generated from web application errors. this log file contain the sequence of errors that appeared on online system,each time an errors appeared on the systems a number of lines is added to the end of the file, the structure of each event is as following followed by < Severity > followed by a java stack trace. The structure of the file at time c: line 1:event a x --- line 4:event b y --- last line:event c z --- The structure of the file at time d could be: line 4:event b y --- line 5:event c z --- last line: event d d --- the event a will be rotated to another file only if it reach 10 MB or the log file could be simply line 1:event a x --- line 4:event b y --- line 5:event c z --- last line: event d d --- The requirement is to automate the monitoring of this file into splunk. The two solution i'm intended to implement are: 1-First Solution is to send the delta changes only to splunk server by writing some shell script do get the delta changes each 5 minutes ( the modification that happened to the files in the last 5 minutes ) 2-Second Solution is to send via ftp the entire file to splunk instance and let splunk monitor the changes. Note that: using universal forwarder is not an option - i have no permission to open a port 9997 or any other port for the forwarder on the production environment but i have the possibility of ftp this file from production server to splunk instance The problem: My preferred solution is the second but i don't know how to monitor only the delta changes in that file, how splunk will indexes only the new events and detect those lines without having any duplication? All idea are welcome and appreciated. Thanks, Roy ... View more

What is the port that splunk universal forwareder use to sent data to the indexer on a splunk instance, what protocol need to exist between universal forwarder and the splunk instance? ... View more

Can splunk monitor a log errors.log that exist on another machine without sending the files via ftp/sftp to splunk server and use monitor option in inputs? Is their a simplest way to monitor a distant log file? Can splunk universal forwarder perform this step and do i need to open new ports for that reason ? ... View more

My Use case: 1- I have a log file X ( a log generated from a web applications - errors.log ) that exist on a server A 2- Splunk is installed on server B In order to monitor this logs, one solution 1 is to send the file X to splunk server B and then used the monitor options in inputs.conf file. I was wondering if an alternative solution 2 could work in order to monitor this log. I need to know if i can use splunk universal forwarder to monitor the log on another machine but i don't know the step yet. Another solution 3 i'm thinking of is to sent the logs to splunk server by email but i don't actually know if that could work. Please i need to know if someone have faced this situation before? and what solution is preferable and what are the steps? ... View more

While migrating my dashboards to sideview utils , i have faced this error during saving my dashboard. Here is the code: | metadata type=hosts | sort host | where like(host,"%wavemark%") host online.wavemark.net <module name="Pulldown"> <param name="name">host</param> <param name="label">Select Environment:</param> <param name="valueField">$name$</param> <module name="Switcher" group=" " layoutPanel="panel_row4_col1"> <param name="selectedGroup">$host$</param> ... <module name="SavedSearch" layoutPanel="panel_row4_col1" group="stagedb.wavemark.net"> <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param> <module name="ViewstateAdapter"> <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param> <module name="JobProgressIndicator" /> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> </module> <module name="HiddenChartFormatter"> <module name="FlashChart"> <param name="width">100%</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </module> </module> ... View more

An exception is throw on the dashboard after calling HiddenSavedSearch module inside a Switcher module saying that HiddenSavedSearch does not yet support layering additional intentions on the top of saved search. ( I actually doesn't now what that mean ? would it be supported in the future?! ). <?xml version="1.0"?> <view autoCancelInterval="90" isVisible="true" isSticky="False" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <!-- autoCancelInterval is set here to 100 --> <label>Reports Performance By Environments</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="SideviewUtils" layoutPanel="appHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutPanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <!-- <module name="HTML" layoutPanel="viewHeader"> <param name="html"> <![CDATA[ <h1>Switcher</h1> ]]> </param> </module> --> <!-- ============================================================================== --> <!-- Setup HostName Selection --> <!-- ============================================================================== --> <module name="SearchSelectLister" layoutPanel="panel_row1_col1_grp1" autoRun="True"> <param name="searchWhenChanged">True</param> <param name="search">| metadata type=hosts | sort host | where like(host,"%wavemark%")</param> <param name="label">Select Environment:</param> <param name="settingToCreate">hostname_setting</param> <param name="selected">online.wavemark.net</param> <!-- <param name="staticFieldsToDisplay"> <list> <param name="value"></param> <param name="label">None</param> </list> </param> --> <param name="searchFieldsToDisplay"> <list> <param name="value">host</param> <param name="label">host</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">hostname_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="hostToken"> <param name="value">$target$</param> </param> </param> </param> <module name="Switcher" group=" " layoutPanel="panel_row4_col1"> <param name="selectedGroup">$hostname_setting$</param> ... <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" group="stagedb.wavemark.net" autoRun="True"> <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param> <param name="groupLabel">Daily Long Running Report Trend</param> <module name="ViewstateAdapter"> <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="HiddenChartFormatter"> <module name="FlashChart"> <param name="width">100%</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> <!-- ** End of ConvertToIntention ** --> </module> <!-- ** End of Host SearchSelectLister ** --> </view> ... View more

Their are no action called "clone" to move extracted field objects from one apps to another, any idea? >> Manager » Fields » Field extractions. Some of my field have no "move" neither "clone" option as action. Does that mean i need to re-create them manually? Thanks, ... View more