upvote for PYRO ... View more

the db connect app is now available from Splunk and it is free. http://splunk-base.splunk.com/apps/50803/splunk-db-connect ... View more

chocking, when someone answers your question, please take the time to click the checkbox next to their response to accept the answer (and give them karma) ... View more

for your patience, i accepted your answer alacer 🙂 ... View more

@bmacias84, you have been a tremendous contributor, i'm offering an additional 50 points of karma for an answer to this that you accept. ... View more

@bmacias84, you have been a tremendous contributor, i'm offering an additional 50 points of karma for an answer to this that you accept. ... View more

i updated the link in the original answer. ... View more

(i accepted your answer, mhibbin :)) ... View more

here are the instructions for adding a network input to Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports you will need to ensure that your wireless access point actually does write syslog. once you have confirmed this, and added the network input, you will be able to search for data from the device in your Splunk instance. you might want to check out the Splunk tutorial if you are new to Splunk. ... View more

where are you seeing the errors? are you running the UNIX app as well on your search head? you're probably seeing other artifacts (like maybe saved searches that power dashboards) that are part of the UNIX app and that also expect the original index name. you might want to just grep $splunk_home/etc/apps/ for the index name. ... View more

what config files are you renaming? the inputs.conf file should be called inputs.conf, not input.conf, is this the problem? ... View more

i totally agree. this will absolutely be resolved very soon. keep an eye on the changelog topic in the Release Notes manual for the next maintenance release and check to see if SPL-59182 is included. ... View more

this issue has been reported (SPL-59182) and is expected to be resolved in an upcoming maintenance release. if you have adequate permissions in your Splunk installation, you can edit reports from Manager > Searches and Reports. ... View more

ok, i updated my answer-- if you want them replicated, you can go ahead and define all the indexes you need in one copy of indexes.conf that you distribute to all the nodes. if you don't want them replicated, you can define them in a separate copy, as explained in the docs. ... View more

if the db you are interested in connecting to has a JDBC driver, it will probably work. here are the instructions: http://docs.splunk.com/Documentation/DBX/1.0.6/DeployDBX/DefineanewDB of particular interest: Note: At a minimum, Splunk DB Connect supports querying custom-defined database connections. For some custom database connections, features related to generation of queries may not work. Additionally, depending on the JDBC driver's implementation of database-metadata, the custom dbinfo search command may not work. ... View more

do you mean SQL Server Express? or hmmm: http://download.cnet.com/dotConnect-for-MySQL-Express/3000-10254_4-10907786.html ... View more

a section of the documentation seems to apply to this situation: "Note: Under limited circumstances (for example, to perform local testing or monitoring), you might want to add an index (or an app with a new index) to one peer but not the others. You can do this by creating a peer-specific indexes.conf, so long as you're careful about how you configure the index and are clear about the ramifications. The data in such an index will not get replicated. The peer-specific indexes.conf supplements, but does not replace, the common version of the file that all peers get. ..." more information later in the same topic: http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Configurethepeers#Add_an_index_to_a_single_peer in particular, your question about replication of the data is answered: "If you need to add an index to a single peer, you can do so by creating a separate indexes.conf file on the peer. However, the data in the new index will remain only on that peer and will not get replicated" edit: i don't think i really answer your question, which i think is: can i just have all the indexes exist on all the peers even if they're only in use on one of the peers? is that what you're asking? further edit: ok so--yes, if you want the content of a particular index replicated, you can/should create a master indexes.conf and distribute it. you must do this explicitly, it doesn't happen automatically. also please note that you must set repfactor=auto on those indexes. that will cause the content of the index to be replicated to the other nodes as defined. ... View more

bringing this answer from sideone over from the app download page: "I have been able to configure windows app to work properly under an alternate index. I have modified the following files: /opt/splunk/etc/apps/windows/default/inputs.conf: Under each stanza, add the following line: index=NEW_INDEX_NAME /opt/splunk/etc/apps/windows/default/wmi.conf: Change all index entries from index = default to index = NEW_INDEX_NAME Better still: - Create a "local" directory under /etc/apps/windows/ - Copy inputs.conf and wmi.conf to /etc/apps/windows/local/ - Delete everything under each stanza heading and replace with "index=NEW_INDEX_NAME" That way your changes aren't overwritten when you next upgrade. If you need assistance, i usually idle in #splunk on EFnet. sideone ... View more

hi wbcattell: i have accepted jworthington's Answer on your behalf, but in the future, please do explicitly accept an Answer on this site if it meets your needs. thanks! 🙂 ... View more

LIKE A SIR ... View more

it sounds to me as though you're going about this correctly--bringing your legacy data into a separate index is a good call. one thing to make sure you understand is how Splunk archives/freezes data, described here: http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy in terms of the source types, if your data is of a standard format (AD, OS, and network devices are all pretty standard), Splunk should do the right thing by default. read more about that here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter http://docs.splunk.com/Documentation/Splunk/5.0/Data/Listofpretrainedsourcetypes hope this is useful. ... View more

could you be more specific about the difficulties you're having? have you installed the app? ... View more