I encountered the same issue. Try going to IE settings, select Compatibility View Mode. Remove Splunk from the list of website and unselected the checkbox option for "Display intranet sites in Compatibility View". This solved my problem. 🙂 ... View more

Just to add one more note, found this to also be an issue if "Enterprise Mode" is checked under Tools in IE. That is not an option available by default but some environments will enable it to enforce compatibility. Once unchecked, Splunk will not render correctly. Here is a link with more information about "Enterprise Mode":http://www.eightforums.com/tutorials/43972-ie11-enterprise-mode-enable-disable-users.html ... View more

I came across the same issue and the first thing I did was also increasing limit to literally 100MB, it's probably quite obvious as value has to be integer but what fixed the problem was setting it to max_memtable_bytes = 100000000 instead of 100MB ... View more

Thanks you guys for a comprehensive explanation. ... View more

I understand that you don't want to reload everything everytime. But why has extract reload=t stopped to work? That's something I would only add to the search when I need the configs to be reloaded! ... View more

The test I did is in agreement with what you say. I did the following test on events where log_type is a sub_string of source. When I filter on log_type (log_type=XXXX), it is around 10 times less efficient than when I filter on source ( source=*XXXX* ) ... View more

Incidentally if you wanted to use the entire regex match, you could have used $0, but I encourage the explicit capture group approach. ... View more

Thanks , for the response.I 'll look it up, and if needed, try a workaround. ... View more

RT and Ad-Hoc remains not being replicated on SHC 6.2.3 ... only proxying is supported but adds a delay on the answer to the users: http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/SHCarchitecture#Artifact_proxying ... View more

The default timestamp behavior for Splunk is to guess the times and assume that they generally go forwards, because it was designed for logfile handling. For data that jumps back 13 years, you may have to set a TIME_FORMAT for the data, and you have have to adjust MAX_DAYS_AGO as well as the MAX_DIFF_SECS_AGO / MAX_DIFF_SECS_HENCE. DAYS_AGO puts a bound on the expected difference betwen file modtime and the timestamps, DIFF_SECS puts a bound on how far timestamps are expected to jump from event to event. Start with a TIME_FORMAT though. ... View more

Thank you for the insight. Followup question. I create a user named splrun on the client machine prior to installing Splunk Enterprise via script. This fails during installation with permission denied issues during the installation. What is the correct method of prepping the delivery location to avoid this problem. Thank You. ... View more

Yep, definitely a case of barking up the wrong tree. The script was throwing an SSL error that I apparently wasn't logging, and it was painfully obvious when i ran that /opt/splunk/bin/splunk cmd python with my script. Once I remedied the SSL error the HTTPS request was fine. Thank you for the nudge. I had nearly given up hope. ... View more

Thanks, I'll try to contact the app author. ... View more

Few things can you verify it from UF to Indexer server. Check the port connections as well firewall rules most of the time TCP error/Cooked data refer to these kind of issues. Telnet to port and IP. etc Try to troubleshoot problem from Network layer to Splunk you will find it. ... View more

The term "index pool" here is unclear, since the only pool terminology we have for indexing is a licensing concept. But assuming you mean you want some splunk index to be modified so that search will no longer return that data, see this topic: http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/RemovedatafromSplunk ... View more

Thanks 🙂 That is helpful, I have removed the empty buckets. I'll keep an eye out if the folders are generated again. That didn't help with the performance issue, another issue that I am still trying to get to the bottom of. ... View more

Hi in my log event and filename date is not present i want give a fix date to log so what is do ? ... View more

You can't change what that host has already logged in the past. You would only be able to change what it is logging going forward by modifying the inputs.conf on that host. You can determine which source on that host is consuming the most with a search like this (sub in the hostname of the offender); index=_internal source=*license_usage.log h=yourhost | chart sum(b) as size by s | sort -size ... View more

could you resolve this issue??? thanks ... View more

Along with @linu1988 answer you could also add Time_Prefix to make little solid. [Sourcetype] TIME_PREFIX= \d{4}-\d{0,2}-\d{0,2}\s TIME_FORMAT=%Y-%m-%d %H:%M:%S.%6q MAX_TIMESTAMP_LOOKAHEAD = 10 ... View more

I agree, it would be far easier just to emit the logs with all contents uncompressed. But for performance reasons that's not a great option for our production environment. We periodically emit from a background thread a single log event with a field containing gzip'd and base64 encoded collection of JSON records. Output looks something like this. 2014-10-04 11:37:27 [pool-2-thread-1] INFO : TxnSummaryLogWriter.logTiming JSON_GZIP_TXN_SUMMARIES [[[H4sIAAAAAAAAAOWYS09jRxBG/wq6a9eon9XV3hGwNBPNAGKMFCkaoeruaoQCJjImioT47ynCLHPhLry5zs6Pbln36NTj8/Ow+3vz+HR/z9tbeRyWvz8P......yG+8XHwAA]]] As these events are written to log, we'd like to get the deltas and unpack the contents to create an event per txn that gets sent to Splunk. I have a simple python script that does this, I just can't seem to figure out how to plug into Splunk's ingest pipeline to run this only on deltas. Scripted inputs would work, but I don't want to have to worry about identifying deltas in my script - Splunk's great at that. And waiting until the log rolls over means an unwanted delay in getting the info into Splunk. ... View more

Hi splunker12er, based on the few log events, try something like this: your base search | rex "(\'((\d{1,3}\.){3}\d{1,3})\'\,\s\')((?<sessionID>[\w\d]+)\'|(?<email>[\w\d\.\-]+\@[\w\d\.]+))" | table sessionID, email this is based on the fact that either the session ID or an email will follow after the IP address. cheers, MuS ... View more

Thanks for the reply. Where to start these commands? At GUI interface or command prompt? I installed splunk on Windows with GUI interface. ... View more