Then: [mysourcetype] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?:XSET|XGET|START|\?|XKS|XDEL) may do it. Or, [mysourcetype] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?!(?:END|\t)) ... View more

So, with the multi-line events, are the inner lines actually indented with spaces or tabs? Or is that just how you formatted it? ... View more

what do the single line events look like? ... View more

Splunk is not good for document search, which is what most website search is. For example, stemming, synonyms, phrases, ranking by proximity, or ranked relevance on things other than time is not native to Splunk's indexing. Nor is extraction from non-text sources such as Word or PDF documents, you will also probably need to spend a disproportionate amount of time dealing with extracting only relevant parts of HTML. ... View more

This is correct, and probably the best you can do. Just note that the administrator of the search head can still have access to all indexers data, as the role/index access is controlled and managed on the search head, not on the indexer. ... View more

No. You're getting the error because the default app/dashboard unless otherwise specified for a user/role is the search app. You need to set the default app for your role to the one app they have access to. I don't know, what capabilities are you uncomfortable with? They of course will need search , and probably the rest_properties_get capabilities. The remainder may or may not be needed by your dashboard, I don't know. You can read about capabilities here http://docs.splunk.com/Documentation/Splunk/latest/admin/authorizeconf ... View more

As ziegfried says, this refers to modifications to the database schema. Besides using a trigger, some database servers can may be able to do something using "virtual columns" or "computed columns" (e.g., to convert a textual only time stamp into a numeric or datetime value). But this approach can be used without modifying the database by defining it in Splunk via a SELECT instead of changing the schema. ... View more

Yes, unfortunately. Your best best might be to use a jquery plugin for session storage and include that in the relevant dashboards. ... View more

You can use: ... | extract pairdelim="." kvdelim="=" ... View more

The batch reader is used when the file is over 20 mb in size. Otherwise, the regular tailing processor queue is used. The batch reader only processes one file at a time, while the tailing processor can do many. The limit exists to prevent a bunch of large files for using up all slots and starving out new smaller files. The threshold can be changed in limits.conf: min_batch_size_bytes = 10485760 to set it to 10 MB, for example. ... View more

GSLB based on DNS usually sets the TTL very low, specifically so that the DNS server can then change the host without the IP getting stuck too long in a client cache. On the other hand, it should not do round robin to the same client, in order for it to work correctly, it needs to keep sending the same address back to any given client, until a failure occurs and it has to tell the client to use a new target IP. ... View more

the TTL specifies how long the client should cache a DNS entry. so if your old one was set to 86400 seconds, while your new is 30 seconds, you'll have problems. ... View more

Based on your envvars, you are trying to run on a Universal Forwarder (UF). You need to run on a Lightweight Forwarder (LWF) or Heavy Forwarder (HF), or else add the Splunk python SDK libraries to the system python on the machine where the UF is running. (The SDK is available here.) The main difference between a UF and a LWF is that the UF does not come with a Splunk python implementation (and the attendant Splunk python libraries), which is the difference you're seeing. It relies on the system python, but the system python doesn't have the Splunk libraries needed. It's certainly possible to make it run on a UF, simply by either: Installing the Splunk python SDK into the system python on the UF machine. Putting the Splunk python SDK libraries into the app Really the right solution would be for the app developer to simply include the Splunk python SDK libraries into the app itself so it comes with everything needed to run on a plain system python. This is fundamentally simple, it's simply a matter of sticking the SDK "splunk" folder into the "bin" directory where the main script that needs it is located. ... View more

On MacOS, the relevant variable is DYLD_LIBRARY_PATH and on HP-UX it's SHLIB_PATH and on AIX it's LIBPATH . ... View more

How exactly did you install and configure the forwarder and the app. It seems to me that the environment that normally Splunk would use has been modified and so the normal Splunk python files (which is located in the site-packages for both 5 and 6) is not found. What does "/opt/splunk/bin/splunk envvars" return? ... View more

And just to be clear, the eventcount command does not require any special permissions. It is the same command that was used on the Splunk 4.x and 5.x pages to display the total numbers of events on the search app overview page. ... View more

I enter it exactly as is in the search bar. It has worked for me in every version from 4.1 or so till now. ... View more

Well, your date format specifies "-", but the data you say uses "/". Also, indexed extractions only work on Splunk 6.0 and higher, not 5. ... View more