I suppose that you have already installed Splunk Enterprise and keep it running?! To get the mentioned data into Splunk there are different ways: 1.monitor the relevant log files, 2. listen to TCP / UDP ports, 3. connect to a db and read the relevant tables or 4. run a script like vmstat etc. and read the output. So the first thing you have to do, is to find out what´s your data like and where it is located. If you know this you will have to plan your deployment. If your data is located on remote hosts you will have to install Forwarders or do a db connect to get the data to your indexer (see: http://wiki.splunk.com/Community:Getting_data_into_Splunk). For special data like AD or firwall see: http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/AuditActiveDirectory and http://wiki.splunk.com/Set_up_Splunk_for_Cisco_Firewalls ... View more

Note, the stack in the screenshot you posted is only 0.5gb/day, so you're bound to run into trouble if you intend to do 30 days at about 1gb per day. ... View more

I did it through the Apps-->Setup - but I was still looking in the splunkd.log for the information. I ran the query per the link you sent index = _internal source=aws and I see DEBUG entries - but not errors. ... View more

Thank you! ... View more

this is an extremely broad question. what do you already know? what exactly do you mean by 'analyze'? as a starting point, i recommend you download the trial version of the product (it's free) and walk through the tutorial--it includes a downloadable data set: http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchTutorial/WelcometotheSearchTutorial you may be able to ask more targeted questions at that point. ... View more

please ask this as a separate question. ... View more

I am not sure about previous versions, but in Splunk 6.4 you can adjust the logo in PDF's: You can substitute a logo image in place of the default Splunk logo that appears in a PDF header or footer. You can specify a path for the image file and adjust the logo position to left, right, or center. You can configure these options using the Mail Server settings manager. Select Settings > Server settings > Email settings to locate the Mail Server Settings page. Scroll to the bottom of this page to find PDF Report Settings. There you can specify your custom logo. ... View more

6.5.5 seems to be analogous to 7.0; And 7.0.1 (not yet released as of this writing) will have all the bugfixes from 6.5.6 according to this document: http://docs.splunk.com/Documentation/Splunk/7.0.0/Installation/AboutupgradingREADTHISFIRST ... View more

thanks for the info about the Answers bug, i will look into this! ... View more

can you tell me what online splunk doc you were looking at? i'd love to help improve things. thanks! ... View more

They should sell a 50cents license key. ... View more

thanks for the feedback, i'll see what we can do. note: if you have feedback in the future, please send it to rachel@splunk.com to make sure we see it. ... View more

Expanding on @martin_mueller 's answer, it should be similar to: [drop] REGEX = . DEST_KEY = queue FORMAT = nullQueue [undrop-test] REGEX = <regex> DEST_KEY = queue FORMAT = indexQueue [test] REGEX = <regex> DEST_KEY = _MetaData:Index FORMAT = test ... View more

Yes, I did notice some change 😉 ... View more

I went through same phase with 1 hour introduction to Splunk by manager, he sent me an e-mail to access splunk web, logs locations related to oracle Middleware WebLogic SOA suite, database and operations document(runbook). After that I came home and installed splunk 5. Read Splunk docs to understand it better. Splunk quickly expanded all over the world. Reading Splunk answers helped me a lot. ... View more

| transaction host startswith=eval(match(_raw,"START]") OR match(_raw,"STARTED]")) endswith=eval(match(_raw,"END]") OR match(_raw,"ENDED]") OR match(_raw,"unhandled")) | where NOT match(_raw, "END]") and NOT match(_raw, "ENDED]") This will pair the unhandled exception with the first START or STARTED of perhaps several that had no corresponding END or ENDED. ... View more

Thank you both for correctly pointing me to what I needed... It clears my understanding on Splunk apps...... ... View more

Just wanted to share here that most of the user community (currently 8,400+ members as of 7/24/19) has moved over to our Splunk Community Slack workspace, splunk-usergroups. https://splunk-usergroups.slack.com. It's been helpful for people to find subsets of the community to connect with based on specific topics and interests (Ex: admin, appdev, itsi, enterprise-security, architecture, dashboards, regex, indexer-clustering, gamers_who_splunk, etc) If you are not a member yet, you can submit a request through splk.it/slack which will kick off an email to you to set up your account. Cheers! Patrick Sr. Community Manager PS - Thanks @renjith.nair for making me aware of this post! ... View more

Aha! After reading docs, tutorials, and having a heck of a time getting my Universal Forwarder connected, this was the answer. Thanks Martin! ... View more

Hi Robert, The next maintenance release is in assurance testing and will be published soon. Splunk releases are cumulative, meaning that future releases will contain fixes to vulnerabilities, new features and other bug fixes. Please bear with us while we ensure the new bits work as expected across multiple platforms and configurations. ... View more

If you want to learn about Splunk data forwarding: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Aboutforwardingandreceivingdata Per default a Splunk Forwarder is sending data to port 9997 on a Splunk Indexer. This connection is a legacy format called "Splunk-2-Splunk" to optimize data transfer. As Martin mentioned you have to setup the Indexer correctly to receive data. HTH ... View more

I am having the same issue ... View more

Hi Hexx, I'm getting in the automatic lookups page when I add a new and running in the 6.2.1 version. Can this works in this version as well. ... View more

I did leave a message and as of now no call back. The system did not prompt me to enter a number. I will call back and leave another message with my entitlement number and call back number. I can put my general call number in the support portal but it will not be of any use when trying to contact me directly. ... View more