Have you created the sccmsummary index prior to running the command? You'll need to make sure the index is in place. Also for your marker command, usually the format of that is key/value. So you might have something like | table Time Total |collect index=sccmsummary sourcetype=sccm:patch marker="total_sccm_patches_needed=true" ... View more

is hostgroup a field in your data? Can you let us know specifically what a true and a false condition would look like? ... View more

Each of these is going to come with it's own unique set of benefits. I am personally a huge fan of Fire Brigade when it comes to managing your data retention policies and troubleshooting a number of index related issues. This has been a really helpful app a number of times for me. The Distributed Management Console is very useful in giving you a look at indexing rates and various performance related metrics, license usage, topology, and forwarder connections. Splunk Health Check Overview will give you some good information about search activity and scheduler activity. There may be some overlap between this and the DMC, but it does have it's own unique set of searches and dashboards. If you were running all 3 of these you'd be able to paint a pretty good picture of your environment. ... View more

What is the app context that the dashboard is in? ... View more

Having never seen the logs and not knowing much about the process here, I'll just ask if it is possible to differentiate your test case in anyway? I'll give you some high level suggestions: Can you run tests from a test host? Can you output test logs to a different file than in production? Do the test events contain any other unique data (test users, etc.)? One other suggestion would be If you only wanted to modify one file, you could change the inputs.conf file to route data to a different sourcetype when you're testing and have that sourcetype always being sent to the nullQueue. ... View more

Is there specific data in that source that is considered "garbage"? With the use of regular expressions you can usually dynamically filter out portions of events or even entire events from being indexed. ... View more

You've uploaded the Lookup Table, have you also defined a Lookup Definition? You'll need to do that to use it in a search. http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Edit_existing_lookup_definitions_or_define_a_new_file-based_or_external_lookup The following is basic but should work provided you have the correct permissions to use the lookup. index=data | lookup test.csv domain_name OUTPUT Reference | table domain_name Reference | stats count by Reference ... View more

Is your data coming into the sourcetype ciscofaults? Is this props.conf file on an Indexer or Heavy Forwarder? Keep in mind MUST_BREAK_AFTER will only be applied if SHOULD_LINEMERGE=true so you don't need the MUST_BREAK_AFTER line. You're probably going to need a different LINE_BREAKER command. Can you post the raw events of a couple events? ... View more

The Cisco Security Suite App https://splunkbase.splunk.com/app/525/ searches data from a number of different cisco devices. Many of those devices have their own individual Technology Add-ons. Those specific technology add-ons are what you're going to want to look at. They will have tags that determine which data model the data is going to go into. The Splunk Add-on for Cisco ASA is a great example. https://splunkbase.splunk.com/app/1620/ For more information on which tags go to which data models you can look at specific data models here: http://docs.splunk.com/Documentation/CIM/latest/User/Overview ... View more

Is there a domain_name field inside of index=data? If so you might want to use the lookup command (http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Lookup) instead of inputlookup. That way you can lookup the domain_name field of each event and return the Reference and then apply some stats commands on that. ... View more

For the Splunk Support for Active Directory (https://splunkbase.splunk.com/app/1151/) it is not required For Splunk App for Windows Infrastructure (https://splunkbase.splunk.com/app/1680/), it is required to populate some dashboards. ... View more

Do you have any reason to not connect your new HF directly to your indexers? It seems like an odd topology to have HF --> HF --> Indexers. Is the universal out of the picture now and you've replaced the Universal Forwarder with a Heavy Forwarder? Will it still match on the same hostname? You're doing that filtering in props with a specific hostname so make sure that hasn't changed. ... View more

I understand wanting to limit this. If you wanted to limit the capability to reloading the deployment server, according to a confirmed Splunk Answers Post found here: https://answers.splunk.com/answers/148344/what-are-the-minimum-capabilities-needed-to-modify-and-push-config-change-from-deployment-server.html All you should need is the edit_deployment_server role. ... View more

Did you receive any sort of errors when you ran the second search? This doesn't sound like any sort of expected behavior. ... View more

This looks like valid JSON according to http://jsonlint.com/ Have you tried setting up a props.conf file with the following: [your_sourcetype_name_here] KV_MODE = json ... View more

This Splunk Answers will get you what you need. If you're not on Windows, the file is in the same basic location $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/build/searchpage.js https://answers.splunk.com/answers/145723/how-to-show-more-than-50-events-on-a-page-in-6-x.html Keep in mind what he is saying is accurate. This is most likely not supported by Splunk and will break in the event of an upgrade. ... View more

@mcnamara I just tested with all of your formats and I think the following should work [my_sourcetype] SEDCMD-accmasking = s/account=(\d{4}-){3}(\d{4})/cc=xxxx-xxxx-xxxx-\2/g ... View more

Are you trying to administer a remote Splunk instance? If so it's definitely possible. Typically you'll simply add -uri https://splunkserver:8089 to the end of your splunk command in the CLI but take a look at the following site for full instructions http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/AccessandusetheCLIonaremoteserver ... View more

Can you try the following? [my_sourcetype] SEDCMD-accmasking = s/account=(\d{4}-){3}(\d{4})/cc=xxxx-xxxx-xxxx-\2/g If that doesn't work are you able to submit a scrubbed sample event? Also for future use: http://docs.splunk.com/Documentation/Splunk/6.0/Data/Anonymizedatausingconfigurationfiles ... View more

If you have Splunk Enterprise on that system, you shouldn't also need the Universal Forwarder on the same system. Splunk Enterprise will do the data collection and index it locally. ... View more

Also keep in mind 2016/05/27 06:30 is 16 characters, so you might want to change your max_timestamp_lookahead to 16. ... View more