You should keep in mind, that this way you allow splunk to read each and every log file after rotating. Also every logfile gets the x-bit set, which is at leastnot necessary and could be a security risk. Alternattively you could do the following (which still gives all rotated logfiles read-permisson for splunk 😞 setfacl -m g:splunk:rx /var/log setfacl -dm g:splunk:r /var/log This way splunk still can enter the /var/log directory and can read - but not execute - all newly created (i.e. all rotated) files. ... View more

As written below for the other answers on setfacl: do not set the x-bit on the files. They are not (or should not be) executed. ... View more

I like the idea of using this dummy file to get up and running. One additional hint: it's better not to set the x-bit as log files are not executed (at least they should not be executed 😉 ). ... View more

For (current in 2018) reference - Regarding port 8089 on Universal Forwarders: In server.conf use: [httpServer] disableDefaultPort = true We set this in a special deployment app for all universal forwarders. ... View more

I know this is somewhat older and maybe current workflows were not available four years ago - but: To package an app, use: splunk package app <app_name> This way all files in local are merged with files already in default (IN default ). The package then can be found under: /opt/splunk/etc/system/static/app-packages/<app_name>.spl and does NOT contain a local directory. Of course you have to install this app in the same location as it already is, to be able to delete the local stuff. An app you create yourself normally should not contain files under local . One thing: if you for some reason don't have a default -directory you have to create it prior to package the app - otherwise you will be left with only that local dir. ... View more

For reference - the link has (some years later 😉 ) - changed: http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro ... View more

Don't copy {noformat} - I believe this is a splunk answers formatting directive. Just start copying with the "| rest..." and end at "...| where isnotnull(errmsg) AND ignore=0". I compared the old and the new command. Somewhere near the middle of the string you had: OLD: ... started=if(key=="time closed", value, started), stopped=if(key=="time opened", value, stopped) ... And after copying you have: NEW: ... started=if(key=="time opened", value, started), stopped=if(key=="time closed", value, stopped) ... Just the bold words were changed. ... View more

To find these things just have a look in the docs for the version mentioned (v6.3) and goto "Release Notes - Deprecated Features". At the bottom you find the following link There's additional info for NOT using Get-WmiObject -class Win32_Product (https://support.microsoft.com/en-gb/help/974524/event-log-message-indicates-that-the-windows-installer-reconfigured-al) as it does the same as WinHostMon://Application did: reconfiguring applications. ... View more

What happens if you set token4 to result.Field2 or ...3 regardless of their value, i.e. without using the if-construct. ... View more

That "missing" part in the splunk concept is: you don't do the field extraction in every single search (although you could for ad-hoc extractions). You define the field extraction once and then use the field (name) you extracted directly inside your search. That way your search strings won't become (much) longer than without using a field at all. Regarding "app": try '^[^\s]{28}\s(?[^\s]+)\s' as regex. If the log line really starts with a blank, put this in front of the first '['. "4. List item" didn't belong to my answer. I just didn't see that one... Please ignore it. ... View more

Do extract fields at search time. That's the recommended way. There's no need to extract the timestamp via field extraction - you just define this in the sourcetype - see props.conf.spec under etc/system/README or in the admin manual on docs.splunk.com Creating a field extraction with the extraction tool should give you the app value in an easy way. What part of your sample log data is the app's name? List item ... View more

Where do Field1, 2, ... come from. Where do the tokens come from? What's the content of abc.csv? ... View more

Your have an All-In-One configuration AND the data source on the same system? ... View more

Are you sure you set your ttl value in the right stanza? It's just a guess that [email] is only for the email-action itself and not for the underlying report/search. Maybe that's the reason that ttl is not mentioned in the email -stanza in the specs file $SPLUNK_HOME/etc/system/README/alert_actions.conf.spec ... View more

Are you familiar with Splunk SDK or SplunkJS? Is this link http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.8.3/splunkjs.Service.Endpoint.html of any help? ... View more

The query you noted is syntactically incorrect (some parts are missing probably during copy&paste) - please provide the complete statement. Additionally: maybe your search statement is not exactly what you want. Please check your NOT and OR parts of the first line. Are they the way you expect? ... View more

You said The goal is to set the token "right" where the column name is completely unknowable. In your final dashboard the fieldnames are created the same way as in your sample data, i.e. through eval expressions? (or is this just to create random sample data?) ... View more

I tried your example. Had to make some assumptions due to different data. So I set span=1h and left out the Target-field (including the overlay). Problem was then, that I got no data at all due to the _time-fieldformat, which I set to some date/time-string. During drill down I got no data, but - I also got no "invalid earliest_time" error. You may have a look in the address field of your browser after doing the drilldown. My address contained: earliest=1529996400.000& latest=1529996400.001& which of course are valid times. What's in your address? ... View more

I re-defined the lookup in my environment and got the same result again. The my_lookup -dir is created and filled during the first call to | inputlookup my_lookup . So it's not surprising that you don't have it. Even after redefinition I got 441 entries in my statistics tab, not more than 1000. So what's in your local/transforms.conf -file regarding your my_lookup (located in the same directory as your lookup-dir)? To check the source: I use cb_2014_us_cd114_500k.zip with a sha256sum of 100d747b89728dd1249a8d83c311691358072e62a9a7aff592edf49321f22083 . My uploaded my_lookup.kmz is 5528634 Bytes in size. Did you define any other lookup named my_lookup some time before? ... View more

Did you select type "Geospatial" in the lookup definition? ... View more

How many events do you get back from "index=myindex"? Is your python script called for every single event? How long does it take to run this script outside of Splunk (one time, ten times, times - with eventcount being the answer to the first question)? ... View more

Where could you see these "more than 1000 results"? After running this command I was directly led to the "statistics" tab with only 441 results. What's in your /opt/splunk/etc/users/<your_login_name>/search/lookups directory? I have: drwx------. 2 splunk splunk 166 21. Jun 12:00 my_lookup -rw-------. 1 splunk splunk 5528634 21. Jun 11:58 my_lookup.kmz and in the my_lookup subdir I got: -rw-------. 1 splunk splunk 328032 21. Jun 12:00 grid.key -rw-------. 1 splunk splunk 63532814 21. Jun 12:00 grid.val -rw-------. 1 splunk splunk 63384 21. Jun 12:00 ray.key -rw-------. 1 splunk splunk 63384 21. Jun 12:00 ray.t.key -rw-------. 1 splunk splunk 13295927 21. Jun 12:00 ray.t.val -rw-------. 1 splunk splunk 20392363 21. Jun 12:00 ray.val -rw-------. 1 splunk splunk 16221144 21. Jun 12:00 seg.key -rw-------. 1 splunk splunk 16221144 21. Jun 12:00 seg.t.key -rw-------. 1 splunk splunk 63532814 21. Jun 12:00 seg.t.val -rw-------. 1 splunk splunk 63532814 21. Jun 12:00 seg.val If you are on Windows I presume it will should look similar - at least regarding the file-/directory names. ... View more

I tried it according to the blog you mentioned and it worked without any complication. Are there any permission problem, e.g. the lookup definition is (app)-private and you try to use it in some different app or context than where you defined it? ... View more

Just leave out the ".kmz" extension ... View more