I think though, that the default behavior is supposed to be that if you have access to the os index, you should be able to use the tags from the search app as well as the unix app. This seems to be the case for the windows app, the default.meta file there is as the unix one "should" be.. ... View more

I was under the impression that setting sourcetype in inputs.conf takes precedence over all others. Following this line of though, if it is correct, then doesnt the sourcetype = syslog in your inputs.conf take precedence over the props.conf sourcetype = syslog_dhcp Since splunk seems to be good at understanding that the data is syslog, could you try to remove the line sourcetype = syslog and perform a restart. What does that lead to? Cheers, .gz PS. The index that you are trying to send the data in, already exists, correct? You cannot try to have data go to a non existing index. ... View more

Do we get to go?!? 😉 ... View more

to confirm that data is not in the system i do a source="udp*" to confirm that data keeps coming in i check the metrics.log as well as search index=_internal source=metrics.log and see that there are events coming in at a steady, almost constant rate. Lastly, as i mentioned, when i do a search on the last one, i add _indextime to the fields and see that it is the same as the timestamp that splunk indexes that event (note, here i am talking about index=_internal source="udp*") ... View more

might need to click on "Show in results" as well... ... View more

Yeap, already there! No need for a new one. ... View more

i can confirm this behavior. ill try and submit a bug for this.. .gz ... View more

In SplunkWeb, splunk User interface that is, if you go to: Manager » Indexes You should be able to see the info you want, per index. It shows the name of the index, its max size, its current size, how many events, earliest and latest event to fall to the index, and lastly the directory path of where the database is for the particular index. Cheers, .gz ... View more

so, it seems to me like you are monitoring a UDP port. Go to: Manager » Data inputs » UDP » And edit your UDP configuration. On the HOST section, choose Custom, and set the custom hostname, or location of the machine, or the type of device..etc. Note that there might be a bug that prevents this from working, a small flag doesnt get set. A secure way to achieve what you want is to actually edit the inputs.conf file manually. Find your monitor stanza for your UDP source it and edit it, it should look something like this: [udp://514] host = Nortel8600 sourcetype = udppackets connection_host = none Cheers, .gz ... View more

To add to this awesome little search query from T. Wolverine one can do the following: index="_internal" sourcetype="splunkd_access" uri_path="/servicesNS/-//authentication/" method="DELETE" What's different? First notice that not ALL users get created/deleted when you are in the search app. Second, notice that the above will also show deleted roles as well. (both can be tweaked to look like T.Wolverine has made them look. - pretty and all.) Notice my search results: # 1 6/4/10 3:34:31.329 PM 127.0.0.1 - admin [04/Jun/2010:15:34:31.329] "DELETE /servicesNS/-/search/authentication/roles/test HTTP/1.1" 200 2009 - - - 3ms # 2 6/4/10 3:34:20.717 PM 127.0.0.1 - admin [04/Jun/2010:15:34:20.717] "DELETE /servicesNS/-/search/authentication/users/tuser HTTP/1.1" 200 2009 - - - 2ms # 3 6/4/10 3:29:40.288 PM 127.0.0.1 - admin [04/Jun/2010:15:29:40.288] "DELETE /servicesNS/-/search/authentication/roles/dudum HTTP/1.1" 200 2009 - - - 3ms # 4 6/4/10 3:28:45.162 PM 127.0.0.1 - admin [04/Jun/2010:15:28:45.162] "DELETE /servicesNS/-/search/authentication/users/dudum HTTP/1.1" 200 2009 - - - 2ms # 5 6/4/10 3:26:01.878 PM 127.0.0.1 - admin [04/Jun/2010:15:26:01.878] "DELETE /servicesNS/-/launcher/authentication/users/dudum HTTP/1.1" 200 2013 - - - 2ms. user dudum was deleted from both search app and launcher app (i added it twice, wrong choice for showing up here but doesnt matter..) Also note that tuser was deleted from search app (which would not have been seen using T.W's query). Also note, in the results you can see the role that was deleted, "test". cheers, .gz ... View more

Official doc: http://www.splunk.com/base/Documentation/3.4/Installation/ConfigureSELinux Also, dont forget to check other threads you open about the same topic 😉 http://www.splunk.com/support/forum:SplunkAdministration/4360/14300 ... View more

what Gerald said the first post! ... View more

how do you know it is not working? - ie. what is your search query that gives you this impression? basically, make sure that index=os is part of your search, otherwise you might not see it (if youre just doing a search on sourcetype=uname) ... View more