Tuning the indexes.conf file will not speed up indexing. If you are having a problem with indexing speed, you should check the internal metrics as well as system resources. If you have enabled the lightweight forwarder app, it is possible that your thruput limit is set to 256 kbps. Without complete details regarding the log source, a more complete answer is difficult to supply. ... View more

Please detail the version of Splunk you are using, as 4.0 differs from 4.1. ... View more

You should check the splunkd.log for why the LDAP authentication fails. If all of the LDAP auth fails, then there is likely a problem with your connectivity to the system. You should ensure that you are not using an alias for the LDAP host and that your LDAP server is not returning referrals. Additionally, if you manually copied the authentication configuration from another machine then you will need to re-enter the passwords so they are encrypted with the correct key. Another possible condition is that your failsafe username exists in your LDAP system, thus causing a conflict. You should make sure the failsafe username is unique. ... View more

If you can detail the types of inputs you will be configuring, that will allow for a better answer. ... View more

I don't believe you need to share a search to have the ability to deliver as PDF. However, if you send a report that contains a saved search that cannot be accessed (is not shared) that may cause a problem for the PDF generation. ... View more

These errors will typically be cleared by a Splunk restart. Also, there is a way to manually clear the restart notification via the Splunk Web manager interface (Manager > Server Controls). ... View more

I would begin by removing each additional pipe function to see what is causing the error. Since the error is in "stats", I would begin by removing the statistical functions. ... View more

It sounds like you want to tune the windows inputs for the forwarding system. See the following link for more guidance: http://www.splunk.com/base/Documentation/latest/Admin/ConsiderationsfordecidinghowtomonitorWindowsdata ... View more

There are a few ways you can input files as search terms. inputcsv and inputlookup http://www.splunk.com/base/Documentation/latest/SearchReference/Inputcsv http://www.splunk.com/base/Documentation/latest/SearchReference/Inputlookup Both of the above commands should allow you to input a csv or similar data. ... View more

Your question is confusing as there is no sample data to reference. Also, your use of parse is confusing. My guess is that you want to produce an extracted field for query terms within google and bing URLs. Please update your question with more details. ... View more

You should post exact events from before and after. Please also post the extraction. Otherwise, it will be difficult to figure out why they have disappeared. ... View more

This can happen if something has changed within the event format or the source/sourcetype has changed. The extractions get applied based on the type of input and then a regex is applied to each event for field extraction. If your new data has a different format it is likely that the field extraction is not working correctly. ... View more

I can help answer your question, but for sharing purposes, can you create a new question? It's a modified search and it uses additional operators. ... View more

The best way to get statistics for this type of duration is to utilize a summary index: http://www.splunk.com/base/Documentation/latest/Knowledge/Usesummaryindexing That would allow you to do complete reporting across all the data over the whole month, on a daily basis. Alternatively: You could enable indexing of the $SPLUNK_HOME/var/log/splunk/scheduler.log file. This file logs when an alert is sent from the scheduler. You would need to find out the exact alert you are triggering. You can then report the total count over 30 days and use your eval statement as described. ... View more

You cannot move all of the Splunk directory within a tar ball to another host. This is not supported. As an alternative, you can create a tar ball of all your indexed information ($SPLUNK_HOME/var/lib/splunk) and move that to the index location of your new installation of Splunk. When doing this, you must first move and unpack your tar ball into the new location prior to the very first startup of the new installation of Splunk. Alternatively, you can have the tar ball overwrite the directory location if you happen to have started it up by accident. ... View more

You may want to consult our sales team as they can setup time with an engineer to help directly answer these types of questions. ... View more

Traditional load balancing with multiple search heads will work for search queries. You would need to make sure the session is "sticky". However, if you want to retain your user preferences between search heads there are some known limitations. A Splunk technical person should be directly consulted if you decide to go down this road. Items such as saved searches and reports, require synchronization between the search heads. Load balancing a network input for most use cases should work fine. This would include syslog or similar input. Using a Splunk Forwarder to load balance between indexers is preferred. Advantages include access to metrics, queueing of data, and input tracking. ... View more

Can you elaborate on the data a bit further? Especially with respect to the specific fields you want to extract (indexed, not-indexed, extracted?). ... View more

You can apply new field extractions to existing data at any time. However, you cannot alter indexed fields such as the sourcetype, source, or index name fields. If you do have indexed fields, there are ways to relabel the data which include usage of tags. ... View more