I think the best here is for you to make sure you understand the process so that you can start storing data in different indexes with confidence, rather than just following a ready-made guide without getting the background knowledge you need to understand what you're doing. The best option IMHO is to read the manual that covers the answer to this question in detail: http://www.splunk.com/base/Documentation/latest/admin/Setupmultipleindexes ... View more

Your props.conf / transforms.conf setup looks fine to me. However I just checked your regex and it seems you have lots of superfluous '+' characters in it - are those in the original regex as well or was it some kind of typo when you entered text here on the site? Also, are the remote forwarders light or heavy forwarders? If they're heavy forwarders you'll want to perform this filtering on the forwarders themselves instead. ... View more

My take on this: first, create the needed field extractions for the logs. Let's call the sourcetype "sendmail" and the fields of primary interest "qid", "from" and "to". Now with these extractions defined, group events together with a transaction based on qid . Then simply make a toplist using top , say for 100 entries. sourcetype="sendmail" | transaction qid | top 100 from,to That should give you something similar to what you seem to be looking for. The only thing missing would be the total count at the end, which you'll have to handle separately. ... View more

Sure. Not sure you can achieve this with simple XML, but it can certainly be done with advanced XML by wrapping your panels within TimeRangePicker modules. The following example takes the saved search "Requests over time" and presents the results as an area chart, where the timerange for this chart is defined by the timerange picker chosen by the user. <module name="TimeRangePicker" layoutPanel="panel_row2_col1" group="Requests per second by action"> <param name="searchWhenChanged">True</param> <param name="selected">Last 60 minutes</param> <module name="HiddenSavedSearch" autoRun="True"> <param name="useHistory">false</param> <param name="savedSearch">Requests over time</param> <module name="EnablePreview"> <param name="enable">true</param> <param name="display">false</param> <module name="HiddenChartFormatter"> <param name="chart">area</param> <param name="chart.stackMode">stacked</param> <param name="chart.nullValueMode">zero</param> <module name="FlashChart"> <param name="height">300px</param> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> <param name="label">View full results</param> </module> </module> </module> </module> </module> </module> You can also have one TimeRangePicker that drives all charts in a dashboard instead of having one TimeRangePicker per chart. All you need to do to get that behaviour is to give the TimeRangePicker its own layoutPanel that is separate from the chart panels, and then wrap them all in, as in the following example. <module name="TimeRangePicker" layoutPanel="panel_row1_col1"> <param name="searchWhenChanged">True</param> <param name="selected">Last 60 minutes</param> <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Requests per second by action" autoRun="True"> <param name="useHistory">false</param> <param name="savedSearch">Requests over time</param> <module name="EnablePreview"> <param name="enable">true</param> <param name="display">false</param> <module name="HiddenChartFormatter"> <param name="chart">area</param> <param name="chart.stackMode">stacked</param> <param name="chart.nullValueMode">zero</param> <module name="FlashChart"> <param name="height">300px</param> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> <param name="label">View full results</param> </module> </module> </module> </module> </module> <module name="HiddenSavedSearch" layoutPanel="panel_row2_col2" group="Bandwidth over time" autoRun="True"> <param name="useHistory">false</param> <param name="savedSearch">Bandwidth over time</param> <module name="EnablePreview"> <param name="enable">true</param> <param name="display">false</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="chart.nullValueMode">zero</param> <module name="FlashChart"> <param name="height">300px</param> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> <param name="label">View full results</param> </module> </module> </module> </module> </module> </module> ... View more

Please explain in more detail what you want to achieve. My impression is that you want to create a field based on a match on a certain size of a word surrounded by whitespace in a log? I.e. in the following event 2011-03-15 03:18 foo fooba gazonk yiff "field1" should match "foo", "field2" should match "fooba". Is this what you mean? In that case you can certainly do that, however could you please first acknowledge whether I'm correct in my assumption about what you want to achieve. ... View more

No, Splunk has a number of ways of recognizing the file's content other than the actual filename so it will not reindex a file just because the name changed. As for the second question I'm not sure what you mean - Splunk itself has no functionality (to my knowledge) for rotating, moving or otherwise modify the log files. All it does is index the data contained in the log files to its own database. ... View more

Net-SNMP is available for Windows, so I'd go for that if I were you. There's also snmpd/snmptrapd functionality in the Kiwi Syslog Daemon. http://sourceforge.net/projects/net-snmp/files/net-snmp%20binaries/5.5-binaries/ This answer has more details: http://answers.splunk.com/questions/4635/how-to-receive-snmp-trap-in-window-machine-from-the-remote-network-device ... View more

Please provide more information, as it is all but impossible to give you a relevant answer without knowing what you want to report on and how. ... View more

Excellent idea. Didn't even know about that function 🙂 ... View more

You can use the functions eval and strftime . Either pull out the year, month and day separately: < your search > | eval todaysyear=strftime(now(),"%Y") | eval todaysmonth=strftime(now(),"%m") | eval todaysday=strftime(now(),"%d") | stats count last(date_year) AS first_year last(date_month) AS first_month last(date_mday) AS first_day BY host | where first_year=todaysyear AND first_month=todaysmonth AND first_day=todaysday Or concatenate them together if you want less eval s: < your search > | eval todaysdate=strftime(now(),"%Y%m%d") | stats count last(date_year) AS first_year last(date_month) AS first_month last(date_mday) AS first_day BY host | where first_year.first_month.first_day=todaysdate ... View more

Syslog broadcast is a new concept to me! Doesn't sound very efficient...but, the easiest thing would probably be to run tcpdump on a box on the LAN, for instance the box you're running Splunk on. If it's indeed syslog though, it should be UDP port 514. ... View more

Does SO work that way? If someone upvotes an answer the question stops being marked as unanswered and updated by community all the time? ... View more

If you're writing the filename you're using correctly, the issue is due to a typo in the filename: the file should be called "inputs.conf" instead of "input.conf". ... View more

Not sure what you're after here. Splunk doesn't itself create any log files from external data, the only log files it creates are those related to Splunk's own operation. If what you mean is that you have a directory, say, /var/log/mylogs, consisting of log files that are rotated so that a new log file is created with a date appended to its name, you just have to tell Splunk to index the whole directory /var/log/mylogs instead of each invididual file in that directory. ... View more

There are a number of ways to do this, but the easiest thing would be to create a field extraction that omits the leading 0. If you search for metrics_ani= otherwise you won't get a match on the events without the leading 0. So, by having a field extraction that extracts the same value in both logs makes sure that you're catching all valid events in your initial search. ... View more

You could use transaction for this as well. ... View more