If you are sending data to Splunk on UDP or TCP, in Splunk on the indexers did you enable data inputs/udp or data inputs/tcp on port 514? ... View more

You need DATETIME_CONFIG. Read a blog entry I wrote on this very thing: http://blogs.splunk.com/2014/04/23/its-that-time-again ... View more

What happens if you run the following command? find / -type f -exec grep -i 'splunkd_stdout.log' {} \; ... View more

Sounds like you should open a support ticket and file it as a request for enhancement. ... View more

LIke that ^^^^? ... View more

Many have used scripts such as: https://answers.splunk.com/answers/34896/simple-installation-script-for-universal-forwarder.html Here is how you can create a system image of Splunk: https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Integrateauniversalforwarderontoasystemimage Perhaps this can help you since I don't have access to Tivoli. ... View more

<nav> <collection label="Dashboards"> <view name="mydashboard" /> </collection> <collection label="Search views"> <view name="mysearchview" default="true" /> <a href="http://www.google.com">Google</a> </collection> </nav> ... View more

The best advice I can give you without seeing any sample logs, is to not depend on an app at all. Learn about how transforms.conf can change your sourcetype for the specific type of log that appears in syslog. From there, learn field extraction and grab the fields that matter for your events, finally, chart it and build your views. Then you will have your apps. Learning core Splunk and its capabilities will be a boon to you. There are numerous examples on answers.splunk.com that show how to transform syslog based on the event patterns, and numerous tutorials on field extraction. Finally, go take the Splunk tutorial and you will be off and running! Good luck! ... View more

Sometimes I just use an LDAP browser to get the right settings like this one: http://www.computerperformance.co.uk/w2k3/utilities/ldp.htm ... View more

http://blogs.splunk.com/2009/08/13/ldap-auth-configuration-tips/ ... View more

Yes, it speeds up search and offloads the indexers from having to perform line-breaking and timestamp recognition tasks too. ... View more

No problem. If the logged events are JSON, this technique is probably the simplest approach as all of your fields will be present without requiring any extra field extraction work. ... View more

Just use this technique: http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Extractfieldsfromfileheadersatindextime Forwarder props.conf entry for the specific sourcetype. INDEXED_EXTRACTIONS=JSON Fields are fed to indexers from the forwarder and searches will be much faster as a result. ... View more

Have you tried using the Splunk App for Stream? You could configure it on the server that mounts the directories, and specifically monitor any port and protocol required. Events will be collected from the wire and logged as JSON events into Splunk. ... View more

Have you tried using the Splunk App for Stream? You could configure it on the server that mounts the directories, and specifically monitor any port and protocol required. Events will be collected from the wire and logged as JSON events into Splunk. ... View more

Have you tried using the Splunk App for Stream? You could configure it on the server that mounts the directories, and specifically monitor any port and protocol required. Events will be collected from the wire and logged as JSON events into Splunk. ... View more

Not sure what version you are using in Splunk, but in any case, just look in the $SPLUNK_HOME/var/log/splunk/splunkd.log for clues. ... View more

Do a test alert email preview from the UI, and check your splunkd.log ... View more

Here is a quick REGEX: https://regex101.com/r/aK7iQ7/5 It could probably be improved. ... View more

That is what I said above. No need to disable anything though, just expand any macros in the data models. ... View more