what version did you install, and what OS are you running? ... View more

also, if you or anyone else has feedback about the docs site, please send email to docs@splunk.com. thanks! ... View more

Joy, if this Answer solved your problem, please accept Kristian's Answer by clicking the checkbox. thanks! ... View more

what version are you running? ... View more

please do! we're gathering information and use cases for this. if you file an enhancement request, please include as many details as possible about your use case--do you want Raspbian on Raspberry Pi or Ubuntu on Calxeda, etc. ... View more

i recommend asking this as a separate question--i don't know the answer, and the question is sorta buried down here 🙂 ... View more

what does 'properly' mean? are you seeing the events in the index? have you tried searching for something you know should be in the events, over all time? ... View more

one thing you could do is install the Splunk on Splunk app, it was created by Splunk's Suport team to help them troubleshoot user issues: http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk you could also review the search in the Search Job Inspector: http://docs.splunk.com/Documentation/Splunk/5.0.2/Search/UsingtheSearchJobInspector in particular, you can see what parts of the search are taking the most resources: http://docs.splunk.com/Documentation/Splunk/5.0.2/Search/UsingtheSearchJobInspector#Execution_costs however, if the search hasn't changed, it's probable that the bottleneck is elsewhere in the system--i'm betting SoS can help. ... View more

hi Janfabo: this is actually a core use case for Splunk. before you begin looking for 'plugins' (we call them apps and add-ons), i recommend you go through the tutorial from the beginning. it will explain how to upload data to Splunk, how to search it, and how to build some simple dashboards. then you will have a better idea of where to start: http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/WelcometotheSplunkTutorial ... View more

BryanBerry: for future reference, the spec/example files in the documentation are populated directly from the same files that you see in the same version of Splunk, so you don't need to check to see if something is in the files on disk if it's not in the docs--it's the same file. that said, i'll make sure the docteam/dev knows that backoffOnFailure is missing from the spec. thank you! ... View more

this documentation topic explains how indexes/buckets work overall, it might be helpful in making your decision: http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/HowSplunkstoresindexes this topic is about performance of search vs indexing: http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Distributeindexingandsearching ... View more

the known issue n8 mentions is this one: Deployment server: 'splunk reload deploy-server' command causes Linux host to freeze. (SPL-62493) ... View more

what version of Splunk are you running? ... View more

aaand the extra 50 points goes to Alacer! ... View more

you must configure the outputs.conf on the forwarder. you must create this file if it does not exist. here is some introductory information about how configuration files work in general in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutConfigurationFiles ... View more

if Jason doesn't decide by the end of today, MuS shall decide! ... View more

not sure if this is what the problem is, but are you explicitly setting the maxvals argument? it has a default value of 100 distinct values to return for each field if you don't set it explicitly. also, can you provide the search string you're using and a sample of the data that is working and a sample of what's not? also, what do you mean by running the query manually? it's a search command, so you can run it on the commandline if you have the necessary permissions. ... View more

i will award an extra 50 karma points for an accepted* answer to this question. *(either the original asker accepts, or MuS says it worked 🙂 ) ... View more

i think what you're looking for is a combination of a lookup and a workflow: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/CreateworkflowactionsinSplunkWeb ... View more

(2+ years later) there is now the Splunk DB Connect App: http://splunk-base.splunk.com/apps/50803/splunk-db-connect ... View more

i took the liberty of copying sridamg's clarification of the question into the question itself, for the benefit of future users. ... View more

thanks for this information, the documentation has been updated to clarify: http://docs.splunk.com/Documentation/DBX/1.0.8/DeployDBX/Addadatabaseconnection#Manage_database_connections_via_configuration_files ... View more

take care of 🙂 ... View more

you should check out the documentation, there is an entire manual about alerting: http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Aboutalerts and please accept my answer to this question. ... View more

no, 37k entries is not too much for Splunk to handle. ... View more