Hello I got a strange error as: Checking conf files for typos... Possible typo in stanza [indexAndForward] in /opt/splunk/etc/apps/linuxForwarder_output/default/outputs.conf, line 8: selectiveIndexing = true There might be typos in your conf files. For more information, run 'splunk btool check --debug' and my outputs.conf is [tcpout] defaultGroup = noforward disabled=false [indexAndForward] index=true selectiveIndexing=true [tcpout:indexer01] server=178.17.0.46:9997 [tcpout:indexer02] server=178.17.0.47:9997 Can you show me why ? i just only copied the word and it seems not to have any erro ... View more

Hello, I don't know what configuration my clientname win23_ ios_____dc_mm should gets in the configuration file below: serverclasss.conf [global] blacklist.0 = * [serverClass:AppsForOps] filterType = whitelist whitelist.0=win23_* [serverClass:AppsForOps1] filterType = whitelist whitelist.0=win23_ ios_____dc* So my question is which serverclass configuration my machine will get ? ... View more

Hello, I have several scripted input written in python. At the beginning, it run well but after about 10 minutes, it stopped running, and in the splunkd.log i just see an error as below: 09-25-2012 10:54:09.821 +0200 INFO ExecProcessor - Ran script: "C:\Program Files\Splunk\etc\apps\Splunk_TA_windows\bin\memory.bat", took -3304.2 seconds to run, 617 bytes read 09-25-2012 10:54:47.977 +0200 WARN DispatchCommand - Modtime 'Tue Sep 25 11:44:45 2012' for 'C:\Program Files\Splunk\var\run\splunk\dispatch\1348566284.10\status.csv' is 2998.0 seconds in the future; please check for clock skew 09-25-2012 11:58:56.175 +0200 INFO WinEventLogChannel - getEvents: Unable to read Windows Event Logs 'System'; rec_id='0'; t_bytes_read='0'; bytes_needed='0'; buf_size='131071'; err_msg(38)='Reached the end of the file.'; 09-25-2012 12:00:18.177 +0200 INFO WinEventLogChannel - getEvents: Unable to read Windows Event Logs 'System'; rec_id='0'; t_bytes_read='0'; bytes_needed='0'; buf_size='131071'; err_msg(38)='Reached the end of the file.'; I don't know why it likes that. It's strange that the error is not concerning about scripted input file . Any suggestion for solving that problem ? ... View more

Hello, As we know that in Splunk Window application, we can use the search: source=WMI:Memory OR source=WMI:CPUTime OR source=WMI:LocalPhysicalDisk | timechart avg(PercentProcessorTime) as "CPU",avg(PercentCommittedBytesInUse) as "Memory",avg(PercentDiskTime) as "Disk" to get performance snapshot by using WMI performance data format But with performance data got from perfmon, the structure is different, and all have the same field called "Value" for each counter of specific instance. For ex: source="Perfmon:CPUTime" collection=CPUTime object=Processor counter="% Processor Time" instance=_Total Value=33.697347893915754 source="Perfmon:Memory" collection=Memory object=Memory counter="% Committed Bytes In Use" Value=34.116872992745115 Can you suggest me how to do a query that gets the same result as the search above but on perfmon data ? ... View more

Hello, I would like to change the Splunk 's ui such as login page by changing to my own logo instead of SPlunk's. And another thing when logged in is that we always see in the top: the logo Splunk -> Home or Splunk -> Manage, i also want to change that words into my desired. For the login page, i read that one can use ui element inside web.conf, but i don't know exactly how to do ? is it possible to change logo ? Thanks ... View more