Here is a step by step for adding a csv file. http://splunk-base.splunk.com/answers/29418/step-by-step-adding-a-new-csv-datasource ... View more

Can you post your method for extracting the user? ... View more

It looks like you have a corrupt index (_internal). You can run this command to check the index: To check the metadata use this. $SPLUNK/bin/splunk stop $SPLUNK/bin/splunk cmd splunkd fsck --index _internal To repair the metadata use this. $SPLUNK/bin/splunk stop $SPLUNK/bin/splunk cmd splunkd fsck --index _internal --mode metadata --repair To rebuild the bucket use this. $SPLUNK/bin/splunk stop $SPLUNK/bin/splunk rebuild $SPLUNK/bin/splunk rebuild $SPLUNK/bin/splunk/var/lib/splunk/_internal/pathtobadbucket Here is a link to a page that describes how to go about repairing indexes. http://wiki.splunk.com/Check_and_Repair_Metadata ... View more

I beg to differ. I just tested it. If you comment out an common entry (line) from a lookup.csv (hence create a non-matching value) then As Is shows up in the results. Are you sure you worded your question correctly? You might want to verify that the value you are entering in the GUI is being sent to the right transforms.conf (perhaps you have a conflicting transforms.conf). ... View more

In Manager > Lookups > Lookup Definitions > your lookup Have you tried Advanced Options with Min = 1, Max = 1, and Default (less than min) = As Is? ... View more

If you cannot access the server that holds the data and install/configure a forwarder on it with ssl certificates, then your best bet would be to go to the site, down load the data from the site with the secure https connection and save it to a computer that does have a forwarder. Verify the data is indexable (csv, key=value, etc...) and then monitor that directory/file. ... View more

With a simple search, do a search for the most recent session ID or other unique field that is listed in the dbx query, and search all time. ... View more

Good (for troubleshooting that is). When you run a query from the DBX console, does it timeout or show any errors? Also, what type of database? ... View more

Is it broken right now? Or have you reinstalled everything? ... View more

Using tail for a one time file index routine is not the best way to go about it. Try it from the commandline - see this post splunk-base.splunk.com/answers/6922/how-to-ask-splunk-to-index-a-file-using-the-cli ... View more

How do you get it working again? Do you get data when you do a simple search? Are the charts and dashboards scheduled? ... View more

Have you tried creating the query at the database and naming it, and then querying the name from DB Connect? I know it is an extra step, but that is how we worked around it. ... View more

Have you installed Splunk? ... View more

I think you need to be searching for bytesRx for bytes received, bytesTx for bytes transmitted, rcvd for bytes received within a connection, and sent for bytes sent within a connection from the syslog. ... View more

Is it a database that can be connected to Splunk with DB Connect? Does it generate a log that contains data you can use? Generally speaking Splunk can analyse any data. ... View more

It actually works very efficient for me because I'm using dbx to monitor database logging. We use a tailing method and therefore the dbx is checking on a schedule and each time dbx checks the database it genenerates a log entry. If we loose the connection to the database then we get an alert, and when the database is connected we are guaranteed that there will be events. ... View more

For some reason the Cron schedule was truncated. It should read zero space star slash one space star space star space star ... View more

You can create a search like: index=yourdbxindex source=yourdbxsource Save the search. Create an Alert for the search: Time: -15m@m now Schedule: Cron 0 */1 * * * Condition: If number of events is less than 1 Send Email: Enable Email Address: your email address This will check once an hour for data from your dbx source. Change the cron schedule to adjust the frequency. ... View more

Have you tried running it "as administrator"? 2008R2 is a very untrusting OS. ... View more

Is this a Windows server or a Unix server? Have you used Splunk to look at the system and performance logs on the server? ... View more

Yes, there is a way to change the password without using the -password parameter. See this article from Splunk: docs.splunk.com/Documentation/Splunk/5.0.3/Security/Deploysecurepasswordsacrossmultipleservers ... View more