I have a Linux forwarder running Splunk 4.1.2. This system uses TCP ports to listen for SYSLOG data from certain devices. When the log data comes in via these ports they are indexed nicely in Splunk. But the host value for these events are set to the Forwarder's host name. Is there a way I can REGEX the incoming SYSLOG information to grab the IP address near the beginning of the SYSLOG data, and set the host to this value? Thanks! ... View more

Hi, I have a Linux system running 4.1.2 of Splunk. On that system I'm trying to use an input (set up in the LOCAL/INPUTS.CONF file) to grab data from a sinkhole directory and set the sourcetype accordingly. The snippet of the inputs.conf is here: [batch:///tmp/proxy1] move_policy = sinkhole index = proxy sourcetype = myweb crcSalt = I also have a LOCAL/PROPS.CONF that has the following information for the sourcetype: [myweb] KV_MODE = none SHOULD_LINEMERGE = False REPORT-myweb_csv = myweb_csv TRANSFORMS-nullheader = nullheader I do see the entries come into the index named "proxy", but the sourcetype does not say myweb, it says "myweb-2". And now I see an entry in the PROPS.CONF file located in $SPLUNK_HOME/etc/apps/learned/local that has the "myweb-2" sourcetype included there. What piece am I missing to allow the sink-holed data to keep the sourcetype I set in the INPUTS.CONF file? ... View more

Hi all, My old, primary Splunk indexer/search head is being retired (v4.1.4). In its place is 4 new indexing servers that are carrying the indexing load for me (all running v4.1.5). Each of these 4 systems were built from scratch, with indexes.conf being moved to them. I'm trying to set this old server to be a search head for the new systems, allowing it to run some scheduled searches this weekend before we retire the server. When I add the search peers to the old system via the GUI, they all go in nicely without complaint. When I log back into the old server's GUI again I get this message on the top of my browser: Unable to distribute to peer named xxx at uri https://xxxx:8089 because peer has status = "Duplicate License". When I look at Manager->Distributed search-> Search Peers I see the 4 peers showing a status of "duplicate license". I've dug around through logs on all systems and nothing pops out as being in error, etc. Any ideas? ... View more

I have a Windows system with 4.1.5 forwarding to my Splunk indexer, that puts out logs in this format: begin error lines of interesting log entries end error I've been noodling around with different options within the PROPS.CONF on the Forwarder system. So far no luck. My goal is to be have the forwarder sear the data correctly then transfer to the Indexing server. Any tips or ideas I'm missing? ... View more

Hi all, I've got the 4.1.5 Light Forwarder (64 bit) installed on a Windows 2008 (64 bit) server. I only have one directory structure and group of logs I'm trying to monitor with the following entry: [monitor://c:\program files (x86)\directory 1\directory 2\directory 3\*\*name*.txt] disabled = 0 When I start up the forwarding software I do see the TCP connection between this server and my indexing system. But no data is being sent across. I've taken the log files from the above tree and placed them on C:\, adjusted my inputs.conf on the system and was able to read the data. Moving the test log file to a made up directory named C:\logs also worked. I copied the test log file to C:\Program Files and modified my inputs.conf and was able to read in the log file. But when I copied the test file to C:\Program Files (x86) and modified the inputs.conf accordingly I could not read the file. Is there something with a special character like "(" or ")" that is confusing Splunk? Steve ... View more

Hi, I'm in the process of taking some of my indexes and moving them to a new server. Currently both servers are up and running Splunk. I changed my forwarder to stop forwarding to the old server and send data to the new server two weeks ago. On my old Splunk server I've manually forced a roll from hot to warm. Then I shut down both Splunk instances and SCP'd the "db_" directory from the old server to the new. When I try to bring up Splunk on the new server I get this error in the logs causing Splunk to not start: ERROR DatabaseDirectoryManager - Splunk has detected that a directory has been manually copied into its database, causing id conflicts [/data/index1/db_1285880963_1273071936_0, hot_v1_0] I followed a previous posting on on ANSWERS - trying to debug my issue: http://answers.splunk.com/questions/838/how-can-you-add-move-a-bucket-without-restarting-splunkd. ... View more

Our web server logs have percent symbols in the entries. I am able to search for certain logs by using REGEX (e.g. REGEX _raw=\/searchresults.html\?ab\=12345\%abc123). But my users are not REGEX savvy. Is there a way to search for characters like %, etc and not use REGEX? Thanks! Steve ... View more