You r putting only one index. You could put index=web logic OR index=another index ... View more

please use Eventgen app for it. You can generate it in your local laptop/dev environment and then upload to Splunk web. Or try to stick a universal forwarder in your local laptop/dev environment to do it automatically to your web. ... View more

Cheers mate. I will try to raise an enhancement request ... View more

thank you for your confirmation. much appreciated ... View more

@masonmorales, thanks for the slide. Any chance to know which RAID configuration you guys use for SSD? ... View more

Thanks mate. Very helpful ... View more

same error here. Need to be fix from splunk ... View more

You can use join, something like.. index= xyz sourcetype=abc | join type=left dest [ search index=snow index dest=* | dedup dest ] ... View more

Cool. I'm not that familiar with web logic, but in websphere add-on you can use "dest" to match "dest" of service now. ... View more

hi, Hope you are familiar with Common Information Model (CIM) ? If yes, please download "Service Now Addon" . This will normalise all SNOW fields to CIM standards and will map to "Ticket Management" model. (All_ticket_management -> dest would be your affected CI for example) Also you can use "ServiceNow" cmdb_ci for asset management. Would strongly advise once your environment grows to use CIM standards for all logs if possible and mapping will be a quite easy task ... View more

Answer from renjith.nair is perfectly correct. But what I would do in an enteprise/corporate system is to create a separate app with various "splunk" web configurations and then put entry into the "local" of it. eg of new app: myapp_prod_web_confs put an entry into "myapp_prod_web_confs/local/web.conf" and put your entries into that. Copy the app (or push the app) and restart ... View more

I too agree, but the client is of opinion that it is not feasible to upgrade all indexers with new hardware everytime. It will be just phased out and there will be always discrepency which is fair. ... View more

did and worked. thanks for saving our upgrade ... View more

Personally, i hate the way Splunk does the Deployer to SHC member deployment. Anything we put in "local" of Deployer will be put into "default" of cluster members. This is making our consistent model incorrect, thus unable to bring TEST environment consistent with PROD. What we do may be wrong, but can bring consistency to different environments, if you are a consistency/version control maniac - "/etc/users/.." are local to SHC . So take a backup for redundancy purpose, but don't do anything with that. - "/etc/myapp/local" folder for app in SHC. This is where updates of app goes into. We take this config using btool and merge into the existing config of "local" in deployer (etc/shcluster/apps/myapp/local). We will re-deploy code from deployer in a weekly manner to SHC members. Thus making SHC member "default" identical as "local". - Every major update/rebuild, we remove items from "local" of apps in SHC and merge again with deployer to bring consistency. - This exact same deployer package is deployed to TEST systems as well to bring a consistent environment ... View more

We tried the anonymise data approach to search for cc pattern in first 5000 characters, but the system almost went down to knees. The above link is good, if we are 100% sure or field where the PAN is coming. But incoming terrabytes of data with whole event scan is performance killer. ... View more

thanks mate. it worked ... View more