Hi nmensah, good news, you dont have to restart the forwarder every time manually! If the UF sees a diff with the installed version of an app or a new app exists on the DS the UF downloads the app and restart automatically. All you need to do is splunk reload deploy-server http://docs.splunk.com/Documentation/Splunk/6.3.1/Updating/Updateconfigurations#Redeploy_an_app_after_you_change_its_content Redeploy an app after you change its content When you update the content of an app, you must reload the deployment server in order for the deployment server to redeploy the app. Note: If you are using forwarder management, you must also manually reload the deployment server if you want to redeploy the app immediately. However, if do not manually reload the deployment server, the app will still get redeployed once you make any subsequent configuration changes in forwarder management. To redeploy an app with updated content: 1. Update the content in the relevant deployment app directory on the deployment server. 2. Reload the deployment server to make the deployment server aware of the changed content. The deployment server then redeploys the app to all clients that it's mapped to. 1. Update the content The topic "Create deployment apps" described how to create app directories on the deployment server. You can add or overwrite the content in those directories at any time. 2. Reload the deployment server After you edit the content of an app, you must reload the deployment server so that the deployment server learns of the changed app. It then redeploys the app to the mapped set of clients. To reload the deployment server, use the CLI reload deploy-server command: splunk reload deploy-server The command checks all apps for changes and notifies the relevant clients. Greetings ... View more

Maybe silly but have you restarted your splunk after you cleaned the savedsearch.conf or did a debug-refresh? Like @hazekamp mentioned "Perhaps this was done via the configuration file system without refreshing splunkd..." ... View more

Hi diogofgm, Looking at your question i stumbled across this: https://answers.splunk.com/answers/89828/mongodb-and-splunk.html http://www.unityjdbc.com/mongojdbc/setup/mongodb_jdbc_splunk.pdf i have not tried to query a mongoDB with splunk, but just from reading the docs: http://docs.splunk.com/Documentation/DBX/2.3.1/DeployDBX/Supporteddatabases#Other_databases In addition to the supported databases that Splunk has tested and certified for use with DB Connect, you may also be able to use unsupported JDBC-compatible databases with Splunk DB Connect. You will need to provide the necessary JDBC drivers to add your own database types. For more information, see Install drivers for other databases. I bet you can do the same with DBX 2 as referred in the pdf/answer above. Maybe it helps ... View more

Hey JamesOwen, I'm glad i could help 🙂 Now logs going in the fun part can begin. Happy splunking ! hgrow ... View more

Oh and if you not quite sure about the input you have setup, you can post it or try to create the input using the UI to avoid any missconfiguration in the input. What versions of splunk and db connect you are using? ... View more

Hi James, be sure you are forwarding all data from your SH to your IDX. outputs.conf [tcpout] ... forwardedindex.filter.disable = true ... There can be filter in place wich data is forward. Ref.: http://docs.splunk.com/Documentation/Splunk/6.5.0/Forwarding/Routeandfilterdatad#Filter_data_by_target_index Next can you confirm that your input is working as intended. Any error for your query if you look at index=_internal sourcetype=dbx2 OR sourcetype=dbx_query_audit hgrow ... View more

Hi tomcochran, i'm glad i could help. I made my comment an answer. Can you do me a favor and accept it? To answer your license questions, it's capacity of data indexed. The events send to nullqueue wont stress your licence. Greetings hgrow ... View more

Hi himapate, try to not use field alias . If you extract both fields (action_failed,action_success) manuelly you can achive the same result as the field alias just by extracting the same value into two fields. Regex 1: " ... (?<action1>(?<action_failed>....))..." Regex 2: " ... (?<action1>(?<action_success>....))..." Hope it helps. Greetings ... View more

If you write your own correlation search, just make sure you provide the following fields in your search if possible: orig_raw, orig_time, orig_cd and orig_splunk_server These fields are necessary for the Original Event Preview to display the raw event and provide the "view original event" link. Greetings ... View more

Hi harish0557, take a look at AddConfigurations Hope it helps ... View more

Hi mlb19, it's nice to hear 🙂 Good luck with your future splunking ! ... View more

Hi mlb19, it's your REGEX thats not match your Event you want to filter. Despite the filtering of windows event what generally happens is, that the REGEX is just looking for a String in your event, that is matching the regex. If you are working with regex https://regex101.com is always a great tool. Just insert your events into the test string field and try your regex. For your specific events 5156 is the simplest Regex that would match the event. But every other event that might contain the numerical sequence 5156 is also filtered. A more precise one could be something like : \d*\/\d*\/\d*\s\d*\:\d*\:\d*\s\d*\s5156 EDIT: less accurate but more optimized regex (\d+.){6}\d+\s5156 Hope it helps ... View more

Hi mlb19, additionally to the documentation ssievert posted a sample event of the data you don't want to index would be helpful. You are right with your inputs.conf (i assume thats a typo). The blacklisting/whitelisting works on files or some inputs like the windows events ssievert mentioned. Otherwise your props.conf and transforms.conf dont seem to be absolutely off. The guess is, thats your REGEX=EventID=(5156) is just not matching your events. Greetings ... View more

bmacias84 was faster 🙂 ... View more

Hi Federica, you are pretty close. Fieldtransformation is done on your indexer (or a heavy forwarder). The following configuration should work: props.conf [test] TRANSFORMS-ipextraction = ip-extraction transforms.conf [ip-extraction] DEST_KEY = MetaData:Host REGEX =(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) FORMAT = $1 In the props.conf [test] is the sourcetype of your input. I assume you have to change it to [subnetwork1] , if thats the sourcetype of your input. I hope it helps. Greetings ... View more

Hi lakromani, there is a dropdown menu with some format options for your visualization. If you click Format -> Genereal -> Stack Mode: stacked its might be what you are looking for. Greetings ... View more

If you are searching for lost configurations splunks btool can be helpful: splunk cmd btool [conf file name] list --debug In your case you would run splunk cmd btool inputs list --debug Hope it helps. ... View more

Hi Arjan, i've just done the same, but im not able to start the app as a user. Does your user/user-role inherits form other roles? If your user/user-role somehow inherits from the admin-role or gets the admin_all_objects capabilitiy the user will always see the app. To make sure thats not the point check the "Selected capabilities" and the "Imported capabilities" for your user-role. Greetings, hgrow ... View more