Hi Logmar, I think you're mixing things.... Let's see if I can clear it for you. First, limiting the "Max Size" of an index only defines the amount of data it'll will use of your disk. If you have an index that's full or almost full and you keep sending more data to it, it'll accept and process the data but will drop/purge the oldest events, keeping the index size within the "Max Size" limit. Now, the license works in another way, it works based on the amount of that an indexer process. For example, if you have an index with the "Max Size" of 100Mb and someone sends an 1Gb log file, the end result will be: Index size: 100Mb(ish) License consumed: 1Gb Searchable data: last 100Mb of the data sent, if it was a single file, the last 100Mb* *please note the figures are just example to understand how it works, there are more variable in the numbers, like the data is stored compressed inside the index, but it should be good enough to understand License Usage vs Max Index Size. Now the solution Splunk offers is to create multiple license pools, lets say, you could create a license pool of 200Mb and assign it to an specific Indexer - note that you can't assign a license pool to an index, you need to assign it to an indexer. In other words, if you want to use that feature, you'll need to install another Splunk instance, make it a Slave of your Master Splunk license server and assign the 200Mb pool to it. All data the Proof-of-concept team produces need to be sent to this "Slave" Splunk. Here a Splunk Doc might help: http://docs.splunk.com/Documentation/Splunk/6.1.4/Admin/Groups,stacks,pools,andotherterminology Hope it helps. Cheers! ... View more

Try to create a field extraction for your source type and use the following expression: ^Windows Installer.+\. Product Name: (?P<productName>.+)\. Product Version: (?P<productVersion>.+)\. Product Language: (?P<productLanguage>.+)\. Installation.+$ One thing I normally do, is to open the site http://regex101.com/ and try the expression there. It's very helpful to understand what you're selecting. ... View more

Hello leujinlove, As starting point the "oneshot" is not intent to be used/called from "inputs.conf". It's for ad-hoc data you want to load into Splunk, like you do when uploading a file using Web GUI. In your example you mixed a script input with the "oneshot", I'll not discuss why you what to load splunkd.log using "oneshot" as I believe it's only an example right?! Anyway, from your example I'll split the options in two: Using one-shot Add to your crontab a line like that: 0 * * * * /opt/splunkforwarder/bin/splunk add oneshot /opt/splunkforwarder/var/log/splunk/splunkd.log -index main -sourcetype ScheduledIndexing -hostname localhost.localdomain -auth "admin:changeme" It'll execute the oneshot command every hour and load all the content from the /opt/splunkforwarder/var/log/splunk/splunkd.log into the main index. Using Script input Do exactly what you did at the inputs.conf but change your script to: #!/bin/bash cat /opt/splunkforwarder/var/log/splunk/splunkd.log What happens here is that a Script input will use the STD OUT from the actual script and load all the output into Splunk, using the index and sourcetype parameters you defined. Script inputs are more suitable for cases where, for example, you need to download something or perform some action not as simple as reading a file. Now if you wish to have a script to perform actions and the end result of the action will be a file you want load... I would use crontab calling a script and at the end of the same script use the "oneshot" command. I have exactly this model working here as I need to scp some content from another server where I'm not allowed to run Splunk Forwarder.... after I scp the files to the local server and perform some sanity checks I call the /opt/splunkforwarder/bin/splunk add oneshot... command, all in a single script. ps.: Don't forget you have the "Monitor" input as well, which is designed to watch files and directories and load only the deltas. Hope it helps! Cheers, Mike ... View more

Hello, Try a simple sub-search to exclude users: index=my_index AND AppName="A" AND NOT [ search index=my_index AppName="B" | dedup UID | fields UID ] | dedup UID | table UID The sub-search will basically list every unique UID that used App B, so we get the results and exclude from the users using app A. Now, if you have a user that never used App A neither App B, it won't show... if that might be a problem you need to use another source, list a list of UIDs instead of start with users using App A. Hope it all makes sense for you. Cheers, ... View more

Check the field extract permissions and if the scope is defined as app or global... try to make it "global" and accessible to everybody. ... View more

Here my 2cents: HeavyForwarders don't support it. As alternative solution I suggest one of below: Use the syslog destination as a FQN A/CNAME in the DNS and update it if you need to failover - Might take some time til the DNS changes to replicate Use a Virtual IP and a Cluster software, something like Linux heartbeat If you have a device like F5 in your network, configure the virtual IP and fail-over rules there Send syslog to both Splunk and perform a Dedup before index the data - waste of bandwidth/load? Send syslog to both Splunk but one of the destinations will be off-line or blocked via firewall - you might have duplicated data if you end-up with both up at same time. Also similar bandwidth issue as above. I'm probably going to have a F5 device in front of my heavy forwarders. The syslogs messages will be send via UDP from the devices but the F5 check rule will be checking the TCP/514 to confirm the service is up. I believe F5 will also allow me to create affinity rules.... Let me know if you have any other idea... I have similar problem with DBX App, that I still finding a better solution instead o manually migrate the configuration in case of failure. ... View more