Manual migration will be an arduous task, as the entire format of that file has changed. Check out 4.0.10 tags.conf versus 4.1 tags.conf After hearing of this failure of the migration script initially, we ran some tests in-house and produced the same error message, but the files were actually migrated successfully and do in fact match the new format correctly. Before you try migrating manually, you may want to verify this. Version 4.1.1 was GA'd yesterday, and includes a fix to the migration script that will resolve this ... View more

You should use - crcSalt = <SOURCE> Don't replace with anything, type it exactly as I have done here. This setting adds a string to the CRC of the file being monitored. If you set it to a specific source string like you have above, then the same string will be added to every file being monitored by that stanza. By setting it to ` `, each file's individual source path will be added to the CRC, ensuring that each one will be different. This setting is case-sensitive, so make sure you use UPPERCASE characters. Disclaimer - applying this setting to files that have already been indexed will cause them to be re-indexed as the CRC will change. Likewise, if you roll a live file and save the old data in the same directory that you're monitoring, that file will be re-indexed as soon as the filename changes. So if you roll your files to *.log.1, or you gzip them to *.log.gz, make sure you add an _blacklist setting so Splunk will ignore them ... View more

On the forwarder, you can specify a new metadata field in inputs.conf using the '_meta' setting. For example - [WinEventLog:Security] disabled = 0 _meta = Terminal::1 This will added to all events coming in from this input source, and will appear as an indexed field on your indexing instance ... View more

1) Windows 2000 is not a supported platform. Splunk will run mostly just fine on it, but there's no guarantee everything will work 100%. Microsoft have already withdrawn genearl support for this OS 2) The 'regmon' script in the Windows app is causing the error. If you disable the regmon input in $SPLUNK_HOME/etc/apps/windows/default/inputs.conf, it will cease to bother you. ... View more

From the Dev side of the house - It's likely just how it was written that way because we didn't want to package an extra module, that stuff isn't native to python. The originator of these sample scripts has left the company so he's not around to clarify, but that's our best guess. This is an example script so if you want to use a radius module, go for it. ... View more

By default on Windows, Splunk runs as 'Local System User' which isn't really a 'user' in the normal sense. It's simply a collection of basic permissions and capabilities that allows Splunk to run as a service, execute scripts etc. Normally, these permissions only extend to the limits of the local box, and to access network resources, you need to run as a user with domain permissions Its all documented here - http://docs.splunk.com/Documentation/Splunk/5.0/Installation/ChoosetheuserSplunkshouldrunas Most notable part - If you intend to do any of the following things, you must give Splunk a Domain account: * read Event Logs remotely * collect performance counters remotely * read network shares for log files * enumerate the Active Directory schema using Active Directory monitoring ... View more

This is a new disk space check in Splunk 4.1, designed to ensure that there is enough space to write search results to disk. Currently it's hard-coded and cannot be changed, but it will be tunable in 4.1.1. For now, the only way to get your searches working again, is to clear some space on the partition where Splunk is running. There's another discussion on the subject here ... View more

If you are seeing this message in $SPLUNK_HOME/var/log/splunkd.log - 04-05-2010 13:45:21.177 ERROR FTHelper - IndexProcessor instance is null, assuming 3.X fish bucket exists, will lazy migrate And the following error in the search app when you log in to Splunk There is no query runner registered This is likely because the migration script from an earlier version of Splunk did not complete correctly. To resolve, you need to get the correct version of $SPLUNK_HOME/etc/myinstall/splunkd.xml in place and restart Splunk. if you download a tarball package of Splunk, and extract $SPLUNK_HOME/etc/myinstall/splunkd.xml.cfg-default - that's the file you need. Installation instructions - stop splunk cd /opt/splunk/etc/myinstall/ mv splunkd.xml splunkd.xml.4x download the extracted file into /opt/splunk/etc/myinstall gunzip splunkd.xml.gz verify permissions and ownership of splunkd.xml (match splunkd.xml.4x) start splunk If you also take a look in $SPLUNK_HOME/var/log/splunk/migration.log , you'll see confirmation of the migration error ... View more

index=_internal source=*metrics.log group=queue | chart perc90(current_size) by name Note: This will give you a table of queues by name. Take note of any queue sizes that are consistently greater than 500. By default, the queue size limit is 1000, so when a queue gets to that size, it is blocked and data-flow stops completely ... View more

The main difference between a regular forwarder and a light forwarder is that the light forwarder doesn't do any parsing of data before sending it to the indexer. A regular forwarder will do all of the line-breaking, event filtering and field extractions - and any other index-time operations you have deifined, before sending the data over to the indexer. A LightForwarder will just assign the host, source, sourcetype and index values to a data packet, and then send it over to the indexer, which will then take care of all the index-time operations. ... View more