As a Splunk beginner, I want to understand few things about kvstore. Could anyone explain me in brief? Is kvstore mandatory for Splunk instance or for a Splunk search head? I understand it is used to write key-value pairs, but how does it differ from lookup? What is app key value store? Also I read it performed CRUD operations on data. How it is doing this? Many thanks. ... View more

I have gone through the Splunk Docs. It's saying that real-time search is basically used to search events before they get indexed. However, I need a few clarifications on this one below. RT search processes un-indexed data. So, how could it identify the both index-time and search-time fields? Will it process the field extractions once it finds a match in incoming events? The data is not indexed yet. So how it could look for its sourcetype, source, and host since all are index-time only? Could someone explain in detail? Thanks in advance ... View more

I have installed Splunk Universal forwarder 6.0.5 in HPUX B.11.11 U 9000/800 box. We are using deployment server (Splunk 6.2.3) to push apps. But the HPUX box where we have installed splunk forwarder is not contacting our Deployment server. While starting splunk for the first time during installation, we are getting the below message. Splunk needs access to the system random number generator to generate security certificates. Normally this is provided by the /dev/urandom device which is not present or accessible on this system. To fix this problem, either: * download the "HP-UX Strong Number Generator" application package from HP's website * or, if the openssl package is installed on the system make sure the "prngd" daemon is running. This is controlled at system startup by the /etc/rc.config.d/prngd file. Do you want to continue anyway [y/n]? y This appears to be your first time running this version of Splunk. Splunk> See your world. Maybe wish you hadn't................................ But splunk has started fine. We are getting below error messages in splunkd.log 06-09-2015 12:15:32.504 +0100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 06-09-2015 12:15:34.360 +0100 ERROR HTTPClient - Should have gotten at least 3 tokens in status line, while getting response code. Only got 0. 06-09-2015 12:15:34.360 +0100 INFO HttpPubSubConnection - Secure HTTP POST failed: Unknown read error 06-09-2015 12:15:34.360 +0100 INFO HttpPubSubConnection - Could not obtain connection, will retry after=78 seconds. 06-09-2015 12:15:44.524 +0100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 06-09-2015 12:11:37.125 +0100 ERROR ServerConfig - No '$SplunkHome/splunkforwarder/etc/auth/server.pem' certificate found. Splunkd communication will not work without this! 06-09-2015 12:11:47.657 +0100 ERROR HTTPServer - SSL context could not be created - error in cert or password is wrong 06-09-2015 12:11:47.657 +0100 ERROR HTTPServer - SSL will not be enabled Can anyone help us figure out why this Splunk universal forwarder is not contacting our Deployment server? ... View more

Hi , I need to extract the host list which are belonging to certain applications ( Listed in my Lookup table ) Need to find which hosts are getting connected to Deployment server and after that need to pick out the hosts which are present in the lookup table. I have used join in my query. It works fine. index=internal host=abcsdf "/services/broker/phonehome/connection" | rex "(?i)^(?:[^.]*.){10}\d+(?P<remote_host>.+?)" | rex "(?i).com(?P<remote_host>.+?)_" | dedup remote_host |rename remote_host as hostname| join hostname[|inputlookup applist] | stats distinct_count(hostname) Any alternate idea to this? Will join consume more time to run? Thanks in advance ... View more

I have made the following changes in my inputs.conf. However no luck Could anyone help me with this? [WinEventLog:Security] ignoreOlderThan=24h recursive=false disabled=false whitelist=1100-1102,1104,1105,1108,4608-4612,4614-4616,4618,4621,4622,4624-4626,4634,4646-4668,4670-4673,4675,4688-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797,4800-4803,4816-4824,4864-4900,4902,4904-4913,4928-4937,4944-4954,4956-4958,4960-4965,4976-4985,5024,5025,5027-5035,5037-5051,5056-5071,5120-5127,5136-5159,5168,5376-5378,5440-5444,5446-5453,5456-5468,5471-5474,5477-5480,5483-5485,5632,5633,5712,5888-5890,6144,6145,6272-6281,6400-6409 index=indexname sourcetype=sourcetypename However the above whitelist filter did not work at all. Specifically I dont want Eventcode 4674 events. So I have omitted it in whitelist.But events with 4674 are not getting filtered. Possible tries: Do I need to specify blacklist? Do I mention like this "Eventcode=4566" ? Do I use anyother stanza to achieve this? Thanks in advance. ... View more

I extracted a multivalued field named universal_ip to extract all IPs (whatever it is source or dest) in all events. One of my event looks like below 12/Mar/2015:13:38:01 +0000] 11.22.33.44 GET /sdffd/sdfsdfh.sdfsdhhf/sdfhsdfhj If I run the query like this (index=* | mvexpand universal_ip | table _raw) ,it returns the result twice for each event. For example the above event found twice in my results. Could you please clarify why mvexpand command gives the result twice. Here single value is found for multivalue field universal_ip. Then how it returns twice? Thanks in advance ... View more

I am in need of the following requirement. Could anyone help me with this? I need to extract the users for 200+ applications as a report. For each application, the agent may differ How to automate this type of report for 200 applications I need to maintain a lookup table like this application,agent abc,123 def,345 efg,456 I need to pass the parameters for application as well as agent in the below query one by one to extract 200 reports How to do that? Any ideas? Need to do any scripts? index=* application=abc agent=123 | stats count by user ... View more