No luck the last time I asked this question, so thought I would try again. Is there any way to have only one entry per forwarder on the forwarder management screen regardless with how many different IP addresses a forwarder might have connected? ... View more

Using 6.01. I understand that the inputs.conf in /etc/system/local can't be managed from the deployment server. The /etc/system/default/inputs.conf says not to modify that file. I see warnings about remotely administering the search app by using /etc/apps/search/inputs.conf to specify the "monitor" clauses. Ok then, where SHOULD one modify the inputs.conf for management through the deployment server. What about etc/apps/MSICreated? I see an inputs.conf in etc/apps/MSICreated/local. What is an MSICreated app? Can one arbitrarily put an inputs.conf in this directory? ... View more

Using 6.0, most of my forwarders show up on the Forwarder Management screen. However, my test machine does not. Is there any way to force it to appear as the/some others do? I've asked this question before, a couple of months ago, but the only answer was crickets. ... View more

After upgrading from Splunk 5 to Splunk 6 some forwarders no longer forward data to the indexer. I haven't found a way to have them resume. I'm wondering if they were somehow "broken" by the shutdown process for the upgrade, namely left in some kind of inconsistent state. Any idea how to find out which (of about 80) no longer forward and how to get them to resume? ... View more

I copied the /opt/splunk directory before upgrading to 6.0. Now I find that none of the forwarders work. They are not forwarding the transactions to 6.0. We don't have the time to send the 6.0 forwarder to the laptops to see if they will work, so we need to restore. What is the procedure? Just delete the /opt/splunk 6.0 structure and copy back the old 5.x structure to /opt/splunk? ... View more

Any idea why entries from forwarder local logs aren't being forwarded to the server after upgrading to Splunk 6.0. Have restarted the forwarder on the laptop but am still not getting transactions. About to have to restore to 5.x from the backup. Edited to note that we upgraded one laptop to the v6 forwarder, but it still isn't forwarding so it has to be something on the server/indexer side. ... View more

source="PerfMetrics" "OPEN PLAN" OSArch=64-bit PlanMode=Server | transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" | PlanSize = PlanSize | etc, etc (It doesn't display in the question, but there are tic marks around the second Plansize above. with a macro of case(NumRows>0 AND NumRows<=50 AND NumDoors>=650, \"S\", NumRows>=200 AND NumRows<=250 AND NumDoors>=650 , \"M\", NumRows >500, \"L\") I've tried both with and without escaping the quotes and also having PlanSize = in front of the case as well has having eval Plansize = in front of the case statement. Also, in the calling search I've tried eval PlanSize = PlanSize and just PlanSize I keep getting: Error in 'SearchParser': The definition of macro 'PlanSize' is expected to be an eval expression that returns a string. Don't know any other combinations to try. Can this even be done using macros? ... View more

I want to search for all records where some field value is greater than X where X is some number. A number of searches reference this same value of X. Where can I store that value of X so that I don't have to change all searches that are referencing it when I need to change X to some different value? Namely, I don't want to have to hard code that value. ... View more