Unfortunately no. We have since moved on from this for now. If you do find a result please let us know here. ... View more

Unfortunately no after clearing monitored directory then clearing the indexes with the command /opt/splunk/bin/splunk stop; /opt/splunk/bin/splunk clean eventdata -f -index bom; /opt/splunk/bin/splunk clean eventdata -f -index bom_summary; /opt/splunk/bin/splunk start I retrieve the files again and Splunk shows zero events in the index. ... View more

Here is a screenshot of the data if that clears things up. http://i56.tinypic.com/xmmyh1.gif ... View more

Thanks for the information. Makes sense from the perspective of 'light' and 'heavy' system usage. ... View more

Did you ever find a solution to this? I am trying to do something very similar but have no idea if it is even possible. ... View more

Ok I seemed to get it to work eventually using the following inputs.conf [monitor:///etc/httpd/logs/access_log*] sourcetype = advanced_access_combined index = webserver disabled = false followTail = 0 host = devserver.remora.com.au [monitor:///etc/httpd/logs/error_log*] index = webserver disabled = false followTail = 0 host = devserver.remora.com.au props.conf [advanced_access_combined] pulldown_type = true maxDist = 28 MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = advanced-access-extractions SHOULD_LINEMERGE = False TIME_PREFIX = [ transforms.conf [all_lazy] REGEX = .*? [all] REGEX = .* [nspaces] # matches one or more NON space characters REGEX = S+ [qstring] #matches a quoted "string" - extracts an unnamed variable - name MUST be provided as in [[qstring:name]] # Extracts: empty-name-group (needs name) REGEX = "(?<>[^"]*+)" [sbstring] #matches a string enclosed in [] - extracts an unnamed variable - name MUST be provided as in [[sbstring:name]] # Extracts: empty-name-group (needs name) REGEX = [(?<>[^]]*+)] [bc_domain] REGEX = (?<domain>w++://[^/s"]++) [bc_uri] # backwards compatible uri regex # uri = path optionally followed by query [/this/path/file.js?query=part&other=var] # path = root part followed by file [/root/part/file.part] # Extracts: uri, uri_path, root, file, uri_query, uri_domain (optional if in proxy mode) REGEX = (?<uri>[[bc_domain:uri_]]?+(?<uri_path>[[uri_root]]?[[uri_seg]](?<file>[^s?/]+)?)(?:?(?<uri_query>[^s]))?) [reqstr] REGEX = [^s"]++ [access-request] # very relaxed regex for extracting fields from the request REGEX = "s*+[[reqstr:method]]?(?:s++[bc_uri])?s+" [advanced-access-extractions] REGEX = ^[[nspaces:vhost]]s++[[nspaces:clientip]]s++[[nspaces:ident]]s++[[nspaces:user]]s++[[sbstring:req_time]]s++[[access-request]]s++[[nspaces:status]]s++[[nspaces:bytes]]s++[nspaces:req_process_time]?[[all:other]] It seemed I needed to copy alot of extras from the /opt/splunk/etc/system/default/transforms.conf which makes sense. Another issue I encountered was that I have a primary index server and the apache files are being forwarded using a 'Universal Forwarder' The whole thing did not work when props.conf and tranforms.conf were on the 'Universal Forwarder'. I needed to add them to the indexing server for the logfiles to be parsed correctly. This is potentially going to be an issue as I would like to get the virtual host in the logfile to be marked as the Splunk host. The host is currently defined on the 'Universal Forwarder' in inputs.conf however I dont extract the virtual host until it hits the transforms.conf on the indexing server. I think by that time it will be too late to set the Splunk host. Anyway I will create a new question for that as it is out of the scope of this one. Edit: The formatting rules here are useless when pasting in conf files so they are a bit munted. If someone needs the configs message me (if thats possible with splunkbase) ... View more

Here is an example log line developer.management.theclient.rdev.com 192.168.31.108 - stingray [06/Jul/2011:12:33:21 +1000] "GET /pop.php?m=testimonial/edit&id=1 HTTP/1.1" 200 166 "http://developer.management.theclient.rdev.com/?m=testimonial/details&id=1" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0" ... View more

Also I have searched all other .conf files and none contain the stanza [WMI:CPUTime] however it is being indexed which is very odd. So by copying the wmi.conf from the windows 7 machine to the xp machine and enabling each stanza got everything working. Thankyou for pointing me in the right direction. ... View more

I had previously read that link but must have missed some crucial parts as I now have some rudimentary indexing occuring on the XP machine with the universal forwarder. One thing I noticed though is that the indexer Windows 7 machine seems to be indexing WMI data locally however all the stanzas in C:\Program Files\Splunk\etc\apps\windows\default\wmi.conf are all disabled however WMI is still being indexed. ie [WMI:CPUTime] interval = 3 wql = SELECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total" index = default disabled = 1 ... View more

Thanks for the response I was worried you would say that. I had thought of the softlink option which would work but would not be ideal It's a shame because the scripted inputs behave in this manner. Would be nice if they were consistent 😉 ... View more

Thanks for the reply. I suppose the best method is to just refresh the page every few minutes. Hopefully they release an update with this soon. That would make Splunk unstoppable. ... View more

Ignore that it is updating live now. Thanks heaps for your suggestion. Another small question is there any way possible to have these 'realtime' gauges start with the most recent value in splunk instead of waiting for the first data point? Also with 'realtime' charts can you have it show live data but start with the last 30 minutes? ... View more

Closer.... That displays the result thanks however the gauge never changes after that even though I know the data is incrementing every second and being logged every 15 seconds. I watched it for about 10 minutes ... View more

Here is an example line May 13 12:41:25 jacona power-engine[32525]: SPLUNK:ChkInpReg, regName=GensetRPM, reg=7, val=3668 Also just to mention these gauges and single values display fine when not attempting realtime. ... View more