It's all good! Were you able to get ahold of a developer license? ... View more

Are you looking for the search schedule to be based on the job name? Or would it suffice to have a search running regularly and have it alert you on certain intervals based on the job name? ... View more

It is not mandatory. Which add-ons you'll want to install depend on what types of logs you're looking to collect ... View more

It's safe yes but if 5 bundles are 2GB that puts them around 400MB a piece which is quite large and worth investigating as the bundle could have issues replicating if it hasn't already. Splunk states that above 200MB is a large bundle http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Configurationbundleissues Potentially there are items that could be blacklisted from being distributed to search peers to help remedy the situation. ... View more

I would try to start by looking at these bundle files to see what is in them that is so large. Large bundles sometimes have issues replicating to search peers so it's best to keep them as minimal as possible. This will also help you determine what was going on when they were so large to make sure it doesn't happen again. Bundle files are simply tar files so you should be able to explore them with any application that can open tar files. In Windows that might be 7-zip or a few other applications that are out there. ... View more

I of course would recommend the lookup table route, but If you're looking to sort of "create" hosts that don't actually exist, you could also do something like this: index=* | eval host=host.",test_host, test_host2" | makemv host delim="," | mvexpand host | dedup host | table host This would give you a list of hosts that actually exist, with the addition of two "fake" hosts called test_host and test_host2. From there you could use the join command on the host field to actually join your list of hosts to actual data in a subsearch: index=* | eval host=host.",test_host, test_host2" | makemv host delim="," | mvexpand host | dedup host | table host | join type=outer host [search index=* | table host index] Finally, you could filter by any hosts with no data in any index index=* | eval host=host.",test_host, test_host2" | makemv host delim="," | mvexpand host | dedup host | table host | join type=outer host [search index=* | table host index] | fillnull index value=NO_DATA | search index=NO_DATA ... View more

I believe this is still not available via the CLI according to http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/CLIadmincommands You could however write a deploymentclient.conf file manually on a host via some sort of script in order to set the name. ... View more

Good luck let me know how it works out! ... View more

If you grab that directory from a Splunk install of the same version it theoretically could. Keep in mind though that we may be chasing down two errors now, whatever the original error was and now the error related to a missing python directory in Splunk. I would say you could give that a shot, but if it doesn't work I'd recommend backing up what's left of the directory, re-installing Splunk, and manually merging back any configs that are important from your backup. ... View more

Can you copy and paste the error? Also I might recommend a re-install of Splunk at this point. That's a critical directory. ... View more

Do you happen to still have the error? What directory did you delete exactly? ... View more

What version of Splunk were you running and what are you running now? You can disable sslv3 in web.conf. See the following page: http://docs.splunk.com/Documentation/Splunk/6.4.1/Security/SetyourSSLversion Another page you'll want to review is the following http://www.splunk.com/view/SP-CAAANKE ... View more

So in the case of [tcp://:514] as an example: If you specify , the specified port only accepts data from that host. If you specify nothing for - [udp://] - the port accepts data sent from any host. ... View more

Ah I see, sorry about that. So your input should be fairly straight forward [tcp://514] sourcetype=cisco:esa:http One thing to note is that if you aren't running Splunk as root, than on many Unix Operating Systems, Splunk won't be able to listen on port 514. You would simply just need to change your input stanza to be a different port and configure your ESA to send to that different port. For example [tcp://5140] sourcetype=cisco:esa:http ... View more

You're actually going to need to configure two different inputs here. 1 is for textmail and http logs. The other is for authentication logs. http://docs.splunk.com/Documentation/AddOns/latest/CiscoESA/ConfigureCiscoESA For Textmail and HTTP Logs I would highly recommend following the app instructions as they're laid out pretty nicely. For setting up Splunk to listen on a specific port, you'll want to use the following document http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Go_to_the_Add_New_page For authentication logs You'll want to use a monitor stanza, but you're going to want to monitor the paths to the files that you are receiving from your ESA administrator. If those are the same as you described above, than that monitor stanza should work. In a file called inputs.conf in $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-esa/local you'll have something like [monitor://\authentication.@20130302T122552.s] sourcetype = cisco:esa:authentication ... View more

For a Heavy Forwarder, usually it's recommended to collect data using something like syslog-ng or rsyslog. You can however setup a tcp or udp input directly using inputs.conf file. See the following Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports ... View more

I'm wondering if your Splunk Universal Forwarder is binding to the Splunk web port on accident. Is there a reason you have these both installed side by side? If Splunk Enterprise is installed on a machine there is generally no need for a Universal Forwarder. Try stopping the UF and Splunk Enterprise and just starting Splunk Enterprise and see if this changes anything. ... View more

Can you try to clarify a little bit more of what you're looking for here? I don't see field4 mentioned in either of your searches ... View more

I can definitely help. I have two questions for you though. Are you consistently going to have two empty lines made up of 4 dashes? There are 3 different timestamps for each "event". Which timestamp is going to be the most relevant? ... View more

Alright I'm going to give you a sample here. Working with JSON can be a little bit tricky but it's usually very possible if it's valid JSON. Since I don't have your exact events I'll show you what I used as a test case. This was my sample.json file { "version": "1.0", "bar": [{ "barName": "name1", "moreRecords": [{ "test": "1" }] }, { "barName": "name2", "moreRecords": [{ "test": "2" }] }] } If I use this as test data and imported it into Splunk using the following props.conf [test_json_sourcetype] KV_MODE = json DATETIME_CONFIG = CURRENT I do get data extracting correctly. I'm then able to run the following search: index=test | spath path=bar{} output=x | mvexpand x | spath input=x | table barName moreRecords{}.test | rename moreRecords{}.* as * | search barName=name1 And that gets me the following output ... View more

Ya it's hard to say without having the actual event. I don't see any reference to bar[0] or bar[1]. Do any of the fields appear to be extracting in Splunk or is it coming in as raw data? ... View more

Do you have the Splunk Universal Forwarder and Splunk Enterprise on this machine? ... View more

What does the format of the log file look like? Is it possible Splunk doesn't know how to break up the individual events? Are all of the events separated by new lines? ... View more