To my knowledge no example is readily available. What I am trying to say is that best practice advice is that end users NOT be adding their own python modules into the Splunk-provided Python runtime. You could break Splunk (admittedly unlikely) or your modules could disappear during a Splunk upgrade (very likely) Please refer to http://answers.splunk.com/questions/8/can-i-add-python-modules-to-the-splunk-environment/17#17 ... View more

What you are trying to do will require what is called a scripted lookup. Start with http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources and go to the section about "Set up a fields lookup based on an external command or script" The fundamental thing to remember is that Splunk doesn't particularly care how your scripted lookup does its thing - it is calling your code expecting it to do the needful. You don't (can't) define database drivers / connections inside of Splunk proper. You can probably do this with Java by putting the proper wrapper script around the java program into the ${SPLUNK_HOME}/bin directory. But, I'd be concerned about the JVM startup time. If you try to do this in python, you'll want the IBM DB2 drivers for python http://code.google.com/p/ibm-db/ These come as a python 'egg' which is pretty easy to install. In your position, I would not try to install this egg into the Splunk embedded python, but would rather put it in the 'system' python and use a small wrapper script to trampoline over to it, similar to Lowell's suggestion in http://answers.splunk.com/questions/2821/python-scripted-inputs-run-with-the-wrong-version-of-python-in-splunk-4-1-2 ... View more

can you supply a couple of sample (redacted if necessary) events? ... View more

The easiest way to verify any SELinux labelling worked properly is with the "-Z" option to ls. But, starting with RHEL5, there are superior tools to chcon for more permanently configuring your SELinux policy to put certain files into a specific context. Look into the "semanage" and "restorecon" tools. ... View more

Hi Mike, Most Splunk solutions that get data from an SQL database require a scripted input on Splunk. Basically, Splunk runs your program which does whatever it does to get the data you want. The program's output is then stored into Splunk as one or more events, depending on how you configure it. One of the trickiest parts is maintaining state of what you've already "extracted" from the database so you don't have duplicate Splunk events. ... View more

Thanks Amrit for the additional detail here. ... View more

(Some additional information for you) The "Search" app's initial Dashboard (the Summary page) is generated by running several searches against the already-indexed data. The sources list runs the following search: | metadata sources This includes an up to date event count which is updated roughly every 25 seconds. More info on the metadata command is available at http://www.splunk.com/base/Documentation/latest/SearchReference/Metadata. As you commented, removing an input from Splunk does not delete already indexed data from the index - it stops Splunk from indexing any additional data from those files. ... View more

I can't comment on official support, but I am successfully running 4.1.x as a lightweight forwarder on AIX 6.1 TL04 with no issues. ... View more

Hi Jean, With current Splunk (as of 4.1) this is not possible. http://answers.splunk.com/questions/3659/combining-historical-and-realtime-searches ... View more

Also, please click the checkbox to the left of my answer to accept it as "correct" - Thanks! ... View more

I've never used lokkit - but it sounds like it may not read the /etc/sysconfig/iptables file itself and/or it flushes the ruleset. You might use 'system-config-firewall' instead. (Me personally, I always just edit the file in /etc/sysconfig) ... View more

When you restarted iptables, you probably blew away the rule you added. Running the iptables command at the shell prompt only updates the in-memory filter table. You should add your rule in the proper place in /etc/sysconfig/iptables and then restart the iptables services. After the restart, verify your rule is there using iptables -nL. ... View more

To Windows, a login is a login is a login. There's nothing special about a user's "first" login of the day. You may want to rephrase this as something more like "How can I write a search to find the first time a user logs in each day, assuming midnight starts a new day?" (Or 5AM, or 6AM, or whatever) ... View more

You could route the undesired event(s) to the nullQueue - see these for more info: http://answers.splunk.com/questions/96/how-do-i-exclude-some-events-from-being-indexed-by-splunk http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata ... View more

Related answer here: http://answers.splunk.com/questions/8567/reading-sql-server-2008-log-files-for-usernames-queries-and-stored-procedures/8572#8572 The SQL server transaction log is binary and somewhat undefined, and won't contain true "queries" (as they do not change the database). It will contain changes, but not in the form of the original SQL statement. This is really not a "Windows 2003" question so much as it is a SQL Server one -- the SQL server engine is going to have to be the one to tell you what is going on. It's possible the "SQL Server Audit" facility will give you the data you're looking for. http://www.bradmcgehee.com/2010/03/an-introduction-to-sql-server-2008-audit/ Quoting from the above blog: Audit data is stored either in a file, or as part of the operating system’s event logs. If you want to be able to analyze and report on this data, you will have to manually import it into your own database. In addition, DBAs will have to manually archive or delete old audit data. There is no built-in reporting, other than looking at the events in the Log Viewer, assuming that is where you store the audit data. For effective reporting, you will have to create your own reports, most likely using SQL Server Reporting Services. Stored in a file is good for Splunk and you should be able to easily use Splunk to provide the 'reporting' and 'analysis' functions. ... View more

Just one dumb question -- is the "$SPLUNK_HOME/etc/system/locals" a typo? The directory is actually "$SPLUNK_HOME/etc/system/local". ... View more

Related/Similar question: http://answers.splunk.com/questions/8764/monitoring-file/8765#8765 ... View more

Steve, can this be considered a duplicate of http://answers.splunk.com/questions/9151/splunk-for-nix-on-aix ? ... View more

That is pretty much it - your data that is not in "_raw" becomes a new indexed field that is included in the index data when the events are indexed. The caveat is these are index-time and cannot be changed/updated/removed without dumping and reindexing data. We use this in my shop today to tag data as coming from "test" versus "prod" for files on the same source path. ... View more

Unfortunate but true - we use a lot of AIX in my shop, and the AIX command set is so wildly different from linux/solaris that Splunk for *nix can't help a lot right now. I've been pondering trying to make patches for it, but I've just not had time. ... View more

I don't see any specific errors in your strace related to locktest - I would suggest putting in an ER (enhancement request) at this point. If you are working with someone within sales, make sure they are aware of your requirement. See http://answers.splunk.com/questions/4844/how-can-i-submit-an-enhancement-request ... View more