It is very rare that Splunk Support will ever ask you to edit any default configuration files. The danger in doing this is that a subsequent upgrade or migration will overwrite your configuration and cause Splunk to break. There may be rare occasions where you will be asked to edit the default config files, perhaps to resolve a bug, and the subsequent upgrade/migration will work properly. In general, do not edit default/*.conf files. ... View more

You can use a site like http://www.epochconverter.com/ to convert epochtimes to "human readable" format. There are 3 parts to the bucket name: db_latesttime_earliesttime_idnum For a bucket named db_1274129994_1273525194_0 you can plug-in the latesttime and earliesttime values to figure out the date/time range of the events within that bucket. The events in this bucket fall between Mon, 10 May 2010 20:59:54 GMT and Mon, 17 May 2010 20:59:54 GMT. ... View more

Assuming you are doing this in version 4.1, let's say you have the following archived bucket: db_1274129994_1273525194_0 Move the bucket to the designated index's thaweddb. For example, if you are restoring to the main index, move it to: $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb Example: # cp -r db_1274129994_1273525194_0 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/temporary-db_1274129994_1273525194_0 Note that, while unlikely, make sure that there isn't a bucket naming conflict. In other words, there should be no existing bucket with the same name in that directory. If so, rename the bucket by changing the bucket id (in the example above, the bucket id is 0.) Run the following command from CLI and specify the admin username:password to force Splunk to recognize the restored data. Example: # $SPLUNK_HOME/bin/splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests -auth admin:changeme ... View more

Out-of-the-box, defaultdb is set to main. To change this, edit your indexes.conf file to reflect the new default index. If you have a new index called "badger", set the following at the top (global setting): defaultDatabase = badger From indexes.conf.spec: defaultDatabase = <database name> * If no index is specified during search, Splunk searches default database. * Also the database displays by default on the homepage. * Defaults to main. ... View more

The search head bears the cpu burden of running searches. Therefore, the configuration at the instance where the user logs in to perform searches, e.g. search head, determines the quota. Check splunkd.log on the search head (or, indexer if that's where searches are run) for the following errors: 05-10-2010 14:22:12.980 ERROR SearchScheduler - Maximum concurrent searches usage=6, quota=6, reached.Search not executed. At this time, we do not have a way to prioritize searches. ... View more

Splunk makes 2 separate calls when performing LDAP bind. It possible that this could work if you are somehow able to bypass referrals for your users listing. This can be done via a combination of: Use Anonymous Bind (your DCs would need to support this) Use a multipleDN configuration for your userBase: userBaseDN = OU=Users,OU=UK,DC=Domain,DC=Com;OU=Users,OU=US,DC=Domain,DC=Com; Use specific filters to return only members of Splunk Role-mapped groups: userBaseFilter = (|(memberOf=CN=SplunkAdmins)(memberOf=CN=SplunkPowerUsers)(memberOf=CN=SplunkUsers)) Use AD GC Port (3268, or 3269 for LDAPS) ... View more

You could configure Splunk to route the test data to nullQueue. Once you want it to index again. disable routing to nullQueue. Example: props.conf: [source::*] TRANSFORMS-nullhost = nullhost transforms.conf: [nullhost] REGEX=. DEST_KEY = queue queue = nullQueue If your QA group is running regular tests, you should seriously consider a separate QA instance so that your Production instance is not affected. ... View more

Scheduled alerts are configurable by the Splunk user. The alerts can be configured to send email to any email address and Splunk does not assume that the configured alert is sent to the user who created the alert. Currently Splunk does not provide the built-in capability to map the email attribute. If you have a use-case for this, feel free to file an Enhancement Request. ... View more

You can configure the polling interval when configuring your WMI input via UI or by editing the wmi.conf file directly. Read the Monitor WMI data section of the documentation for more details about what is configurable and examples: ... View more