could you be a bit more specific about what you're trying to do? ... View more

this is rather drastic, but you could change the input's timestamping properties (in props.conf) to use DATETIME_CONFIG = NONE , which means it will base the timestamp on the 'time of receipt' by Splunk. ... View more

you are such a problem child! 🙂 this is almost certainly related to a bug that some experienced as a result of case mis-matching between splunk.com and answers' underlying identity mgmt foo (although your situation is not identical). we have filed a bug specifically to address your issue, and are expecting a fix soon. keep your nappy on! 😉 ... View more

hi! i will award a 50 karma bounty to the first person to provide a good/correct answer to this question! ... View more

http://i.imgur.com/IGAYk.gif ... View more

i believe what you're talking about is called lookups: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Aboutlookupsandfieldactions typically, this feature is used to bring in information from said spreadsheet and add it to your search results, but you can also use the 'outputlookup' command to write results from a search to a file on your filesystem: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Outputlookup if you ran a scheduled saved search that included an outputlookup command, you could achieve the situation you describe, although it won't update the spreadsheet automatically just by opening it. this module might also achieve some of your goals; http://splunk-base.splunk.com/apps/29336/splunk-for-excel-export but i'm in retrospect (thanks #splunk IRC!) thinking you meant this: http://splunk-base.splunk.com/apps/58162/odata-for-splunk ... View more

let us know if this fixes the issue, and i will convert Kristian's comment to an answer 🙂 ... View more

i'm working on it! 🙂 it will be posted at docs.splunk.com when the app is out of Beta. ... View more

if you're talking about the "Splunk for Fisma" app (http://splunk-base.splunk.com/apps/44883/splunk-for-fisma) the Splunkbase page for the app says "This app does not provide data inputs, extractions, or tags itself." and goes on to explain that you need to configure inputs yourself via other technology add-ons and ensure the data conforms to the Splunk Common Information Model. ... View more

you can absolutely migrate your data if your Windows instance is from 4.2 or later, just use the procedure here--use the first half of the *Nix procedure and the 2nd half of the Windows one: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Moveanindex it might be easiest to hand-move all the config content in /local/ one file at a time to make sure you switch the direction of the slashes etc, but all the configs are the same (except for your inputs, of course). ... View more

in the future, if the answer is correct/solves your problem, please accept the answer by clicking the checkmark (i've done it for you). thanks! ... View more

i have updated the Splunk App for XenDesktop docs to include this information: http://docs.splunk.com/Documentation/XenDT/2.0/DeployXenDT/InstalltheuniversalforwarderontheVDAs#Using_a_shared.2Fdistributed_image ... View more

please note that you will want to update your monitor every time a new version of Splunk is released, because the Known Issues page gets branched. ... View more

the answer to the question asked in the title of this posting is: the license isn't expiring. it is enforcing the terms of that license as documented. once your deployment has fewer than 3 violations within the noted 30-day period, you will once again be able to use Splunk to search your data, indefinitely. in the meantime, i recommend you reduce the volume of your inputs so that you no longer violate the terms of the license more than twice in a given 30-day period. here is additional information from the official product documentation about the intended use cases for Splunk Free: "Splunk Free is designed for personal, ad-hoc search and visualization of IT data. You can use Splunk Free for ongoing indexing of small volumes (<500 MB/day) of data. Additionally, you can use it for short-term bulk-loading and analysis of larger data sets--Splunk Free allows you to bulk-load much larger data sets up to 3 times within a 30 day period. This can be useful for forensic review of large data sets." ( http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree ) note that Splunk Free is intended for personal use. if you are using Splunk Free in an enterprise environment, and require access to support under an SLA, i recommend you purchase a license. ... View more

if you have an existing 4.1 license, you can retrieve it from your 4.1.x deployment using the information in this topic: http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/InstallYourLicense and install it into your 4.3 license master using the info in this topic: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Installalicense ... View more

licensing changed a lot starting in 4.2, so i recommend reviewing the documentation about it before proceeding: http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks assuming your 4.1.x licenses are still valid, you should be able to designate one of your Splunk instances as the license master: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurealicensemaster and just install your existing licenses on it for use by your pool of indexers. ... View more

how the "time range" what? ... View more

assuming this upgrade was from 4.2.x to 4.3.1 (and not 4.3 to 4.3.1) the only thing i can think of offhand that might be impacting you in this situation is this: http://docs.splunk.com/Documentation/Splunk/latest/Installation/Aboutupgradingto4.3READTHISFIRST#Splunk_expects_canonical_IP_addresses_in_its_configuration_file_stanzas ... View more

can you provide the URL for that help link? (hover over, right click, copy link) ... View more

in particular, there is information about storage/sizing here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/HowHowmuchspaceyouwillneed ... View more

i'm taking a guess here that you're seeing an error about performance possibly being impacted due to the number of jobs in your dispatch directory. if that's the case and what you're asking is to make the error go away, you can change the value of dispatch_dir_warning_size in $SPLUNK_HOME/etc/system/local/limits.conf to something higher. if that's not it, please be more specific about the 'index error' you're seeing. ... View more

Error 1310 is a Windows permissions-related error. make sure that the user you are installing Splunk as has the correct permissions as described here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindows#Choose_the_user_Splunk_should_run_as ... View more