I have not heard of specific plans to include it, but certainly it is discussed and the requests have been made. If you make Enhancement Requests for it, it will be more likely to be weighted more heavily. Similar requests were made for native RDBMS input support, and the Splunk-supported DB Connect application to provide this was the result. ... View more

sqlserver. the message and complaint is entirely from mssqlserver. ... View more

... | eval new=mvappend(field1,field2) Though I would ask what it means to you to have two values in a single field in a single record. Using a Splunk multivalue field is one way, but perhaps the answer given by another poster where you simply concatenate the string values together is more appropriate. ... View more

Yes. You need to calculate a duration ( eval duration=strptime(end)-_time , if start is the timestamp of the event), and you can then use the concurrency search command. Alternatively, you can create separate events for start and end, and simply count the number of start events and number of end events since the beginning of your time range, and take the difference to get the concurrency. ... View more

Sorry, no. You'll just have to type it out. You can try using a macro to shorten your typing, but you're still going to have to specify the field base names. ... View more

This is actually the purpose of the coalesce() function, and it's probably a bit easier to read as well. ... View more

I'm not sure why you're not seeing this, as this is normally in the output. As you know, for some types of events, much of the relevant information about the event is contained in there, and many of the Splunk applications make use of this to be able to properly report. (e.g., if you have a security audit event, the file name is in the data section). Windows 2003 R2 should be new enough. In some cases, if a DLL containing the data template is not available to Splunk, it may not be displayed. Could that be the problem, say, permissions for the Splunkd user to the DLLs that contain the event data text? ... View more

Just to clarify, the term "apps" is probably misleading. An "app" is nothing more than a configuration bundle, i.e., a set of configuration files, that are merged with all other configuration bundles present on the system. ... View more

I think what you want is exactly what is handled by the standard Splunk configuration system, since multiple inputs.conf files are merged if they are in multiple folders. Please read the documenation on configuration files to see how to arrange the files, as well as rules on conflict resolution. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles ... View more

Yes, use a subsearch that loads a lookup csv file: sourcetype=things NOT [ inputlookup iplist.csv | fields ip_addr ] The iplist.csv lookup file should contain a column called ip_addr . if the field name in your sourcetype does not match the column name in the lookup file, you can use the rename command to rename the field. ... View more

Then you would do it using $SPLUNK_HOME/etc/apps/* . This has the capabilities equivalent to what you're asking for. ... View more

I don't know what you mean by a "/etc/splunk.d/"configuration structrure, but all splunk config is contained under $SPLUNK_HOME/etc/system and (more suitable for your use) $SPLUNK_HOME/etc/apps/* . Details of how those are laid out and resolved are in the docs, here and in following sections. You can (and plenty of people do) have puppet or chef place configuration files there. What exactly are you trying to do that this configuration structure doesn't work with, or that is makes harder? ... View more

It appears the Heroku output is a TCP syslog stream, so I think you should be able to use the TCP rather than UDP input. ... View more

Or if you write to a file, a long enough (default 3 seconds) pause in new data written to a file will cause the file monitor to force an end to the event. There's no way in a scripted input to force the end (add a "_done" key) but you can do this in a modular input. ... View more

Add SHOULD_LINEMERGE = false to your props. Splunk is waiting for the next event to see if it needs to merge it into the current one, so it can't index the current one until it sees that the next one contains a valid date. ... View more

good question. ... View more

You are correct. In the current version of the API (5.0.2), only total index usage, not per volume, is reported. Furthermore there is no interface that I am aware of that reports on volume usage (whether actual disk volumes or Splunk indexes.conf-defined logical volumes) ... View more

Here is what you can do: http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/RemovedatafromSplunk It is possible to delete entire "buckets" of data if you know what you are doing. Using the dbinspect command, you can find the buckets that contain data from the time range of interest, then stop and remove the directories. However, this will almost certainly also remove information that is outside of the data you're looking for, unless you're quite lucky. ... View more

If you're just setting the source to a static value, you can do it via transforms, as kristian.kolb suggested, but it might be simpler to just do: [monitor:///my/log/path/BEK*.log] sourcetype=BEKlogs source=BEK.log However, if you're going to do that, I might just suggest you ignore "source" and use "sourcetype" anyway. If on the other hand, you want to preserve part of the source path, e.g., you are monitoring files like: [monitor:///my/path/*/logs/BEK*.log] and you want the source to read like /my/path/group1/logs/BEK.log , you would use kristian's method of a transform, but you would need a more complex REGEX and FORMAT to extract and use the appropriate parts of the source you want. ... View more