C:\Program Files\SplunkUniversalForwarder\bin>splunk.exe restart SplunkForwarder: Stopping (pid 2032) Splunk> Take the sh out of IT. Checking prerequisites... Checking mgmt port [8089]: open Checking conf files for typos... All preliminary checks passed. Starting splunk server daemon (splunkd)... SplunkForwarder: Starting (pid 1780) Done. ... View more

I think that's what you're looking for can be achieved by. index=summary source="SI Count By Host Every 10m" | top limit=10 orig_host However, if you would like to use your search you could also achieve the same by: index=summary source="SI Count By Host Every 10m" | stats count by orig_host | sort limit=10 -count .gz ... View more

There are two issues going on here. Why are the files not being moitored and how to actually monitor them Why are there no errors in splunkd.log First, Splunk will not index binary files. Even if you have a file.dat.gz that is not binary, and you specify NO_BINARY_CHECK, Splunk will still fail to index the file. This is because there is stanza in /etc/system/default/props.conf that tells splunk not to. [source::....(0t|a|ali|asa|au|bmp|cg|cgi|class|d|dat|deb|del|dot|dvi|dylib|elc|eps|exe|ftn|gif|hlp|hqx|hs|icns|ico|inc|iso|jame|jin|jpeg|jpg|kml|la|lhs|lib|lo|lock|mcp|mid|mp3|mpg|msf|nib|o|obj|odt|ogg|ook|opt|os|pal|pbm|pdf|pem|pgm|plo|png|po|pod|pp|ppd|ppm|ppt|prc|ps|psd|psym|pyc|pyd|rast|rb|rde|rdf|rdr|rgb|ro|rpm|rsrc|so|ss|stg|strings|tdt|tif|tiff|tk|uue|vhd|xbm|xlb|xls|xlw)] sourcetype = known_binary Note that this is not just happening for .dat files but happens for all the above extensions.. In order to actually have the files indexed then we need to create (or edit) a props.conf within /etc/system/local/ with the following stanza: [source::....(dat)] sourcetype = mysourcetype priority = 20 This will overwrite the default/props.conf and will tell splunk to use a different sourcetype for the .dat.gz files, and hence allow them to actually be indexed. The reason why there was no message in splunkd.log is because of a bug, which has been filed and our friendly devs will soon be working on it. Hope this helps someone out there.. .gz ... View more

This can be one way of dealing with this; i must admit, you seem quite limited in resources but: i dont think 1 would be an issue if 2 and 3 were not around. (i would guess that these logs will only grow so large at very rare occasions and not constantly and all time) From 2, it seems like you should run LightWeightForwarders which have the lowest footprint and CPU usage From 3, it seems like you are being bandwith limited and cant really send the data to the main indexer which is in a different location.(that would be the ideal option) If it is possible to have an extra box dedicated to splunk in the remote location, then you can install splunk as an indexer (at this remote location), collect the remote logs into this indexer and then allow the main splunk indexer to search the remote one, (basically adding search peers). ... View more

This took a little bit of digging and poking the UI dev's but can be achieved quite nicely. There's a file in /splunkhome/share/splunk/search_mrsparkle/modules/results where the results are formated. around line 72 we have: % if i18n.current_lang_url_component()=="en-US": ${i18n.format_datetime_microseconds(event.time).replace(' ', '<br/>', 1).replace(' ', '&nbsp;')} % else: ${i18n.format_datetime_microseconds(event.time)} % endif This is the file that i will be working with. First thing to note however, is that i will be making changes to the code, and as such i do not want to make these changes on the default file for two reasons: If i break things then splunk will not support any further issues i might have in the future any future upgrade will overwrite my changes and make my efforts go to waste. Hence, i will create a new app, where i will put all my file changes, and since apps have higher precedence my changed file will be read over the default one. Start start by creating a new application within your splunk instance: pwd /splunkhome/etc/apps Make new app directory by: > mkdir time > mkdir time/appserver > mkdir time/appserver/modules/ > mkdir time/appserver/modules/results > cd time/appserver/modules/results > pwd /splunkhome/etc/apps/time/appserver/modules/results Copy the file from the default location into this app/directory: cp /splunkhome/share/splunk/search_mrsparkle/modules/results/EventsViewer_default_renderer.html . ls EventsViewer_default_renderer.html Modify this file such that the if-condition on line 72 looks like so: % if i18n.current_lang_url_component()=="en-US": ${(event.time.strftime('%d/%m/%Y %H:%M:%S'))} % else: ${i18n.format_datetime_microseconds(event.time)} % endif Refresh your web page, and your /en-US/ will look as if it was /en-GB/ through out all your browsers all around the company. One thing to note: adding %f right after %S will add microseconds. 6 significant digits of them. I was unable to only show just 3 significant digits, like the default splunk view is. i tried %3f %.3f etc, but none of them seems to be working. If anyone finds the solution to this it would be cool. Hope this helps people out there. Cheers, .gz ... View more

This is already in place. If you would like users to only access part of the data, then you make sure that you split the data in different indexes. Then, you assign the "default indexes" and "indexes" to specific roles. You need to go to Manager » Access controls » Roles » user and give specific permissions to the role. Default indexes = what a default search will look at. Indexes = what a user can actually specify in the search, for example, "index=abcd" Default indexes Set the index(es) that searches default to when no index is specified. User with this role can search other indexes using index= (e.g., "index=special_index"). Indexes Restrict this role's searches to the specified index(es). Search results for this role will only show events from these indexes. ... View more

Hey Steven, Spent some time on this but i think i got it to work. Try this: index=_internal [search index=_internal | head 1 | eval earliest=if(date_wday="monday", "-3d@d", "-1d@d") | eval latest=if(date_wday="monday", "-2d@d", "@d") | table earliest, latest | format "" "" "" "" "" ""] if you are running the search on monday, it should go back and look at only the friday data. If you are running it on any other day, it will look at the previous day only. Be careful however, this is not taking in consideration running this search on saturday or sunday. You could have a more nested if, for the earliest but that was too complicated and it didnt seem that you needed it anyway. Let me know if this worked for ya. Cheers, .gz ... View more