My post has nothing to do with format. It simply states that you can use the rest endpoint post your date. That endpoint is https://:/services/receivers/simple. ... View more

My viewpoint is that in situations where a workaround can solve a problem with monitoring, probably Splunk should try to auto-solve that problem so workarounds are not needed. Not to set unrealistic expectations: there could be types of problems that would require redisigns of the splunk file monitoring component and could be very expensive and take along time to become available. However, as a rule, we have continuously added fixes and improvements to handle edge cases like this over the years. The linked answer is about one such specific situation. I do not know, at the moment, whether we have shipped improvements to better handle that case since 2014. ... View more

post cleanup, you might want to try 'splunk validate files' to be sure the files on disk now match the files in the provided manifest. ... View more

I've tested this and provided configuration examples here: https://answers.splunk.com/answers/556300/how-can-i-use-clone-sourcetype-to-send-a-cloned-mo.html?childToView=556305#answer-556305 ... View more

Thank again for your continued assistance. It might be helpful to amend your question I tried, but my reputation is not high enough yet to post more than two questions/day. There's much about your reply that I do not yet understand: If you have that behavior on How do I know if I have that behavior on? I understand what you mean by making the TRANSFORMS-x setting a list and specifying my stanza second. But when I look at my default/transforms.conf, I see two transforms related syslog hosts. How would I figure out which one I should put ahead of mine? [syslog-host] [syslog-host-full] you are relying on the reverse DNS behavior of data-accept Not sure what that means exactly. I have this statement in my inputs.conf - is this what you mean by having it configured on or off? In your experience if people "turn it off" because of slow DNS, do they typically just deal with host= in their queries? Or do they use the technique I'm using? connection_host = dns ... View more

If anything, this represents the work at the end of an alert to decide if it's time to fire or actually emit the alert actions. It doesn't correlate with the running searches. The concurrent workload of scheduled searches (both those you might consider alerts and otherwise) should be available in a accessible form within the Splunk Distributed Management Console, which uses the server/status/resource-usage/splunk-processes endpoint as its source information for live data (as accessed via |rest) and uses the introspection data for historical concurrency information. Specifically, it digs into the data in the introspection index, from the resource_usage.log or sourcetype=-splunk_resource_usage data for component=PerProcess where data.search_props.type=scheduled. Theoretically you could build a picture from scheduler.log, but you'd have to compute overlaps based on the dispatch_time and run_time of each alert, and this is pretty ungainly. If you wouldn't mind turning this followup into a specific question -- how can we review the concurrent search load of our scheduled searches? -- I think it's a far more common goal and I don't see a clear question asked along these lines. Keep in mind, of course, that the apportionment algorithm of the scheduler means that the concurrency of scheduled searches might drop in times of high contention with searches launched either via ad-hoc user behavior, or dashboard loads. (The Splunk search quota and apportionment machinery essentially considers searches stored in dashboards or invoked on-load by dashboard loads to be equivalent to user-typed searches.) ... View more

Using the GUN Parallel option above mentioned by kbecker did the trick for me... I modified the process a bit and had a loop outside that to check every bucket instead of just the single bucket that the example they have shows. I don't have the commands handy right now though. ... View more

For the "when to use" question, I think this is really a workflow thing. Tags allow people to identify key-value pairs (aka fieldname fieldvalue pairs) that categorize items. This can be done incrementally and collectively. For example, if you notice a host should be tagged as a webserver and it is not, you can add it at the time that you are viewing it. If the tags are shared (not private), this means that some grouping of people can be collaboratively creating these groupings, building shared knowledge. Eventtypes allow people to create labels based on search expressions. This means you have one definition of what that label that is centrally managed in a single configuration. In cases where that search expression will cover the entire category now and in the future, it can be simpler and more managable, but if if the category definition is an arbitrary list of values, it would be a poor workflow fit for maintenance reasons. There are probably other differentiators in the messy details, but I think this is the main distinction. ... View more

Already answered, just a link to the relevant docs. See bottom of page. ... View more

It sure would be great if someone could communicate what behavior is known to correlate with this message. That is, is it a nuisance? Is this a performance affecting situation? do you get incomplete search results? ... View more

I downvoted this post because author later stated the answer does not work ... View more

Splunk the software may currently permit this configuration, but it should not be used. Among other possibilities, scheduled search time-to-run expressions are not timezone-independent. ... View more

Installed on 10.11 without any xcode. Hit the DeRez requires dev tools dialogue. Hoping to avoid installing xcode and more heft/cruft/config, but also reluctant to fake the path as per the above solution as it means my notes on recovering the solution become pages long. Found an alternate temporary solution; just Install the command line tools http://osxdaily.com/2014/02/12/install-command-line-tools-mac-os-x/ Hopefully Splunk will find it! ... View more

Hi Luxiaobin, please mark this as an answer if it's the correct comments. It appears that I was correct and if you're going to be storing values as times, I'd be tempted to say do it as different fields, dob_day, dob_month, dob_year. Something along those lines ... View more

I downvoted this post because downvoting without a clue. ... View more

Thanks for the detail explanation. Your description is the same as I thought. Basically, it's mainly for the workflow in Splunk 6 UI. ... View more

Agree jrodman - your suggestion is cleaner than what I was proposing. Thanks. ... View more

You cannot add a windows path as input on a lunix server. If you just want to index the file, copy it over to this directory on the Splunk Indexer $SPLUNK_HOME/var/spool/splunk everything in there will be indexed automatically. ... View more

Can you edit props.conf to process json files? http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in-answer&utm_term=props.conf&utm_campaign=refdoc and then something like: search | rex "(?\{.*\})" | spath input=json_input |table fields ... View more

For this particular goal, I would usually make the .+ be ungreedy with .+? e.g. | rex field=url_field "http://(?<url_path>.+?html)" ... View more

I think you're right - I should have used coalesce ... View more

Glad you found it out and shared it with us ! 🙂 ... View more

I would say rather that it's possible to configure the system to use the CherryPy/SplunkWeb server in the same WAY as 6.1. It's the same code regardless of the configuration. ... View more