Splunk can't do anything about logs that doesn't reach it. In the case where you have Universal Forwarders sending logs to a Splunk indexer, the forwarders have buffering mechanisms to make sure that logs will not be lost in case of a (temporary) network failure. In your case, it's your Java application failing to send the logs, so it's up to that application to implement mechanisms for avoiding data loss. ... View more

No, "deprecated" does not mean "removed". The functionality is still there, but is due for removal, and the recommendation is to explore other options instead. ... View more

You shouldn't configure a receiving port, you should configure a data input port. Receiving ports are reserved for forwarded traffic between Splunk instances. ... View more

http://docs.splunk.com/Documentation/Splunk/6.2.0/releasenotes/Deprecatedfeatures ... View more

fschange is deprecated. Recommended option is to use each OS's native mechanisms for auditing filesystem activity, like auditd in Linux. ... View more

There is a hard limit on 10500 results for subsearch output. There's no way around this. Sorry. ... View more

No, upgrading from 6.0.4 to 6.2.0 should be no problem to perform straight away. You might want to check out the docs though just to make sure you're familiar with the changes. http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/Aboutupgradingto6.2READTHISFIRST ... View more

Did you dump traffic to see that traffic on port 514 is actually reaching the machine? Another thing to try when verifying things is to run a realtime search in Splunk. That way you see exactly what data is coming in, so if there are issues with incorrect timestamps for instance you would still see the logs coming in with the realtime search. ... View more

Not so much "logged off" as that the user's session expires and the corresponding session cookies are invalidated. This is not logged anywhere that I know of. ... View more

No, because Splunk has no way of knowing whether someone closed the browser window. All that happens is that requests stop coming from the browser. ... View more

This should prove useful: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F ... View more

Troubleshooting tips: Make sure that Splunk is actually listening on port 514/UDP, as a data input port, not a receiving port that you would otherwise configure in "Forwarding and receiving". Make sure that the traffic is reaching your system by sniffing on the network interface, for instance using a tool like Wireshark. Verify that no local firewall is interfering with the traffic so that it's blocked before reaching Splunk. ... View more

From a performance perspective fields is better because return is an external script rather than being directly built into Splunk. So fields would be the better option. ... View more

Well, something like this: index=idx sourcetype=ST earliest=[search index=idx sourcetype=ST | head 1 | eval nowstring=strftime(now(), "%m") | eval earliest = if(nowstring==1, "-13m@", "@y0") | fields earliest] latest=now ... View more

Yes, it's definitely possible to do this (we do pretty much exactly this ourselves). Describing how would take a long time and depends on more exact details of your scenario so it'd probably be better to raise this discussion with your sales rep / engineer or for that matter Splunk's professional services. Depending on whether you're planning to use your central infrastructure to search and alert on things in your clients' environments you might run into some challenges with having Splunk treat different environments differently. For instance if you want to treat assets individually per client you need to find a solution that makes sure that you're not mixing assets from different environments. ... View more

That depends completely on what eventtypes you have, what your definitions are for "virus events", and a number of other factors. Please provide more details with log samples and fields, and we'll stand a better chance of helping you. ... View more

I disagree with that interpretation. The documentation states: This function takes one or two numeric arguments X and Y, returning X rounded to the amount of decimal places specified by Y. It makes no sense in this context to mention negative integers at all. ... View more

What's the idea with supplying a negative integer there at all? ... View more

A crude way of debugging it would be to setup a very simple transform just to make sure it's working, and then go from there. You can see which settings splunk "sees" by running the following command in Splunk's bin folder on the heavy forwarder: splunk cmd btool props list --debug And correspondingly for transforms.conf: splunk cmd btool transforms list --debug Also you might want to make sure that you're really running a heavy forwarder and not a light forwarder. Oh and if the data you're masking is coming from another heavy Splunk instance from the beginning this won't work. ... View more

Also your output format looks weird. FORMAT is not denoted in regex. You probably want something like REGEX = (.*\s\d{6})\d{6}(\d{4})$ FORMAT = $1######$2 Or for that matter, why not use SEDCMD: props.conf: [yoursourcetype] SEDCMD-maskstuff = s/(\d{6})\d{6}(\d{4})$/\1#####$2/ ... View more

Is the sourcetype for your data really "test-masking"? ... View more