It may be helpful to share any errors that you are seeing in the splunkd logs. http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/WhatSplunklogsaboutitself I would recommend using the Splunk on Splunk App in the future which will help you search across all Splunk logs when you have an issue like this. ... View more

There is no option to "clone" an app in the UI. As you mentioned, you can simply copy the app folder structure. Why would you want to clone the same app, are you planning on creating different dashboard views based on the same index? Just to help same you time creating App for different data? That makes sense but it helps when you can give more details of why you want to do, whatever you are asking. ... View more

Have you tried using the default sourcetypes for access logs? If you assign the sourcetype of access_combined for example Splunk should automatically create the fields for you. Just change the sourcetype in your inputs.conf setting for that file monitor and restart splunk. http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes In case you run into any issues there are a lot of other postings you can look at here to see if one can help you as well: http://splunk-base.splunk.com/search/?q=apache&Submit=Search ... View more

You can just download a new version of Splunk and install it as your test environment if you do not care about any of the old data in that system. Move your existing configuration files over if they are still valid. YOu will have the full trial for 60 days and you can then convert to the free license. Here's a good view of the differences once you convert to the free verssion. http://www.splunk.com/view/SP-CAAAE8W ... View more

As long as you have the line breaking correct for the events in Splunk than a regex like this (?<=bandwidth\s)\d+(?=\s) to replace what IFX is coming up with should work. Just go into the config file and change it directly or if you've already deleted it, replace it in the IFX when you create the extraction. ... View more

There is no restriction on access for the Trial license in terms of having multiple people look at Splunk. However, once you go over your 60 days and do not purchase an enterprise license you will need to convert to the free license with the following features disabled: The Free license includes 500 MB/day of indexing volume, is free (as in beer), and has no expiration date. Multiple user accounts and role-based access controls Distributed search Forwarding in TCP/HTTP formats (you can forward data to other Splunk instances, but not to non-Splunk instances) Deployment management (including for clients) Alerting/monitoring http://docs.splunk.com/Documentation/Splunk/latest/Admin/TypesofSplunklicenses ... View more

Please read this and it will give you the details for how to monitor windows events. http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorwindowsdata ... View more

These should help you. http://splunk-base.splunk.com/answers/58868/splunk-storm-trouble-adding-forwarders http://splunk-base.splunk.com/answers/58992/datas-are-not-sent-from-my-machine-to-splunk-strom-web-ui ... View more

It usually makes sense to break down your search and track when you are getting data and then where you aren't getting what you expect. Start with the beginning and then add additional commands one by one to see where the search is breaking down. ... View more

Extract that archive to the /etc/apps directory. Restart Splunk. ... View more

That's more of a Cisco specific question, however this might help. If not, I'd suggest looking at their docs. http://splunk-base.splunk.com/answers/12790/details-on-how-to-configure-ironport-for-e-mails-to-log-to-splunk ... View more

You need to download this add-on and follow the README file instructions. http://splunk-base.splunk.com/apps/22305/splunk-for-cisco-ironport-email-security-appliance ... View more

For the current day, data that you've already ingested, yes. But you do get the ability to go over your daily license limit. If it's splunk free you have 3 times in a 30 day period, if it's a purchased license you have 5 times in 30 days. Data stored does not matter against the license other than the fact that you'll need a little more disk space to hold onto it depending on how much data you are talking about. ... View more

Doesn't look like that regex is going to work. I would start with REGEX = 10.12.0.20 just to see if you get one device coming in. What is the semi colon...the or operator should be a pipe '|' so that won't work. If you want to do this based on the host you can also use SOURCE_KEY = MetaData:Host to apply the regex to the host field as well. ... View more

You'll want to install the Universal forwarder on each linux server. Then set up a monitor for the log files (/var/log/ folder) and forward to the indexer. On the indexer you'll need to enable receiving in the manager. See our docs below. http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutforwardingandreceivingdata http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories ... View more

If that is what you need, than you should just use the real time search option for those dashboards. http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/RealTimeDashboard ... View more

I think you may be looking for the commands head and tail. | head 1 will give you the latest event and tail will give you the earliest for your specified time range. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/head http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Tail ... View more

what is your setting for [source::...]. Don't change anything else. ... View more

I updated above. ... View more

What is the data coming from? You could use the interactive field extractor in the UI to get Splunk to generate the regex for you. http://www.splunk.com/view/SP-CAAADUY ... View more

Updated: The sourcetype expected for the app is riverbed_steelhead. Take a look at the props.conf file and the transforms.conf file in the default directory. In props.conf, you may need to add the stanza header. See link below, since i'm not sure why it's not like that in the app already. Something like this: [source::udp:514] TRANSFORMS-riverbed_src = riverbed_src Then transforms.conf already has this which is setting the sourcetype of the incoming syslog based on a regex. Restart splunk. Once you can do a search for 'sourcetype=riverbed_steelhead' and see data, the app should populate for you. [riverbed_src] REGEX = ([a-z]+)(([\d+])|): [([A-Za-z0-9/_\ .:]+).(INFO|NOTICE|WARN|ALERT|ERR|CRIT|EMER)] DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::riverbed_steelhead In props.conf make sure you reference the right sourcename. Examples here of what they have done. http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides ... View more