http://apps.splunk.com/app/725/ http://lmgtfy.com/?q=splunk+vmware&l=1 ... View more

In addition to both these answers it's important to note that the date_* fields do NOT always exist in events. It only exists for events where the timestamp processor has parsed the timestamp. This is not the case for Windows event logs sent from a forwarder, for instance. If you want to make sure you always have the field date_hour , you could do something like this: ... | eval date_hour=strftime(_time,"%H") | ... ... View more

Or eventtypes. Take your pick. 🙂 ... View more

Yes. Check out the frozenTimePeriodInSecs setting in indexes.conf. By setting this to 7776000 (90 days in seconds) Splunk will delete data in its index when it becomes older than this limit. You're asking about deleting "index or log" - not sure what you mean by that, but Splunk will not delete any of the actual log files that it's read data from, that's something you need to set up separately. http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Indexesconf ... View more

First of all, props.conf settings are case sensitive so "break_only_before" needs to be BREAK_ONLY_BEFORE, and so on. ... View more

Ummm well in which directory are you standing when you issue that command? "./splunk" will only work if you're in the directory where the splunk binary resides, which would be "/opt/splunkforwarder/bin" on a forwarder. If it's a full-blown Splunk instance, the directory would be "/opt/splunk/bin". ... View more

By default indexers do not automatically replicate data. You can enable this behaviour though by setting up index clusters. The docs have excellent explanations on how it works in detail, so I'll just refer to those: http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Aboutclusters ... View more

You could do this if you used eventtypes instead of (or in addition to) macros. You would set up an eventtype with this search you provided, and then use the eventtype name as your descriptor. eventtype will be included as a field so you can just include that in your table and get what you're after. ... View more

I've filed an ER for metasearch to output _indextime in results. With that, you could quickly grab these stats. ... View more

You could use something like importutil to grab the URL's directly each time the saved search runs. To create a filter out of the output, run importutil in a subsearch. Something like this: index=proxylogs [importutil "http://some/url" | multikv | fields url] ... View more

Why use any function at all? responsetime should already be numeric if correctly extracted. If it's not correctly extracted, then that's the problem that needs to be solved. ... View more

What do you mean by "sync the sourcetype"? What do you mean by master node? It seems like you have some terminology that you need to get straight first of all. ... View more

Oh hm. When giving the time in the format you provided I'm getting an invalid format error. Try using YYYY-MM-DDTHH:MM:SS. For instance your earliest time would be "2014-06-30T11:40:00". ... View more

That's because CLI search doesn't use those options. They are called "earliest_time" and "latest_time", respectively. http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/CLIsearchsyntax ... View more

Setup a TRANSFORMS rule in props.conf / transforms.conf. Something like this: props.conf: [originalsourcetype] TRANSFORMS-changesourcetypes = changesourcetype1,changesourcetype2,changesourcetype3 transforms.conf: [changesourcetype1] REGEX = yourregexforsourcetype1 DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::sourcetype1 [changesourcetype2] REGEX = yourregexforsourcetype2 DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::sourcetype2 [changesourcetype3] REGEX = yourregexforsourcetype3 DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::sourcetype3 ... View more

You can create as many as you want, however more indexes do not mean better performance. If you keep your data in many different indexes it's rather the opposite, as if you don't specify a specific index in your search Splunk will need to open each index to check if events that you're searching for are in there. Dividing up data across several indexes is not something you do for performance reasons, rather it's something you do if you want either different periods for how long data will be kept, or different access permissions (for instance user A is allowed to access index X but not index Y, whereas user B is allowed to access index Y but not index X). ... View more

Splunk keeps all issued searches in its _audit index, so you can look there. Something like this: index=_audit action=search info=granted search="*select * from table1*" ... View more

If you want to compare results with other results from a while back, did you look into using the timewrap command? https://apps.splunk.com/app/1645/ ... View more

By default it's not recorded anywhere. What you could do is redirect your script's stderr output to a file and look there: f = open("/path/to/some/file","w") sys.stderr = f ... View more

This is way too vague and broad a question to answer properly. ... View more