Please refer to this blog post on the command you can run from CLI. You can write a cronjob to run the command on a regular basis to keep your group membership list updated automatically. Note that this only applies to versions 3.x and 4.0.x. In version 4.1, the manner in which we cache LDAP user/group information becomes more dynamic and so reloading authentication is not necessary. ... View more

I think it is important to mention versions here. In 4.x, we have app.conf In version 3.x we have the MANIFEST file. When migrating from 3.x to 4.x there is no app.conf created during migration. Thus, we have the undesired behavior of all apps from version 3.x disabled via MANIFEST file are now enabled after migration to 4.x ... View more

In general, we don't advise that you edit limits.conf unless you really know what you're doing. In this situation, you should be able to modify the following settings in $SPLUNK_HOME/etc/system/local/limits.conf (listed below are the defaults in version 4.1): [search] max_searches_per_cpu = 4 [scheduler] max_searches_perc = 25 Let's say your instance has 2 cpus. The number of (concurrent) searches per cpu, based on the default settings, will be 8 searches. For scheduled searches the default is 25% of that number so your max concurrent SCHEDULED searches (which applies to summary indexing searches) will be 2 concurrent searches. If you're only running summary searches on this machine, you could raise the max_searches_perc up to 100 meaning that up to 8 scheduled searches can run concurrently. If this system is not utilized by anything else, you could potentially raise the max_searches_per_cpu setting as well. After modifying either of these settings make sure to monitor your system for a period of time to ensure it is not being overtaxed at any point in time. ... View more

Splunk's current behavior is that it does not keep track of paused or backgrounded searches after a restart. ... View more

Try hitting this url: https://yoursplunkhost:8089/services/admin/inputstatus/TailingProcessor%3AFileStatus replace yoursplunkhost with your splunk server name replace 8089 with your configured mgmt port number. This only works if you changed the admin password on the Splunk instance/universal forwarder. Otherwise you can run this command on the host: ./splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus ... View more

You can set the thruput in limits.conf via the [thruput] stanza. Example: [thruput] maxKBps = 256 Alternatively, you can set maxKBps = 0 to lift any thruput cap. At this point you'll be limited by your actual bandwidth. Enabling the LightForwarder or using an universal forwarder will automatically set your thruput to 256 maxKBps. The same setting, when used on an indexer will also limit its thruput. ... View more

As of version 4.0.10 and 4.1, summary indexed data DOES NOT count against your license! ... View more

Assuming that the events made it to your custom index, have you verified that you are actually searching on that index? To be sure, specify the custom index in your search terms: index=custom_index Since its a new index it is probably ok to search across "All Time" just to be sure the events are there but maybe improperly timestamped. If you want to be able to search this custom index by default, you'll need to add it as one of the default indexes to search for the role in question. This is done by editing your authorize.conf file. For example: [role_user] srchIndexesDefault = main;custom_index ... View more

The splunk_server field specifies the peer: splunk_server=<peer_name> You can use the value "local" to refer to the Splunk instance that you are searching from; in other words, the search head itself: splunk_server=local ... View more

Assuming you have forwarding to indexer properly configured, as mentioned by BunnyHop, you'll just need to specify the custom index for your input at the Forwarder in an inputs.conf file. Example: [monitor:///var/log/*.log] index = linux It is important to mention that you must verify that the specified custom index exists on the indexer, otherwise your events go into a blackhole (which is the non-existent custom index). The custom index can be created with a custom indexes.conf on your indexer: Example: [linux] homePath = $SPLUNK_DB/linux/db coldPath = $SPLUNK_DB/linux/colddb thawedPath = $SPLUNK_DB/linux/thaweddb ... View more