Installed via command line with: msiexec /I splunk...msi /qn ALLUSERS=1 REBOOT=ReallySuppress AGREETOLICENSE=Yes RECEIVING_INDEXER="indexer:7900" myapp/defaults/inputs.conf: [monitor://C:\WINNT\system32\LogFiles\HTTPERR] disabled = false sourcetype = iishttperr ignoreOlderThan = 3d [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] disabled = false myapp/defaults/perfmon.conf: [PERFMON:Web Stats] counters = Total Connection Attempts;Total Method Requests;Total Bytes Sent disabled = false instances = _Total interval = 300 object = Web Service Splunkd.log says: 06-02-2011 15:25:15.893 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Web Service(*)\Total Connection Attempts' error 0xc0000bb9 06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" splunk-regmon - No enabled entries were found in the conf files. 06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" Using logging configuration at C:\Program Files\SplunkUniversalForwarder\etc\log-cmdline.cfg. ... View more

When planning my Splunk deployment I didn't allow for a separate deployment server. My 2 indexers are quite brawny (16 CPU, 64 GB) beasts that are not being taxed in any way, so one of the indexers could likely support a deployment server in addition to it's normal load. Are there any advantages to making a fresh install of Splunk on the same box, listening on different ports obv, compared to just activating one of the Index installs as a deployment server? There will be a few hundred SUF installs talking to the DS. One of my concerns is restarts required by changes to the DS. (Not having run a DS for any real install, I'm not clear how often a restart is required.) Thanks, jon ... View more

Windows 2003 with SUF, inputs.conf: [monitor://C:\WINNT\system32\LogFiles\HTTPERR] disabled = false sourcetype = iis Linux running the indexer, props.conf: [iis] CHECK_FOR_HEADER = true [iis-2] CHECK_FOR_HEADER = true Based on testing with oneshot uploads beforehand, I didn't need either of those but added them during troubleshooting. The logs are being tagged correctly by the forwarder with an iis sourcetype -- iis-2 in this case. The fields are not being identified however. If I upload one of the log files from the forwarder into the indexer via the web interface and specify iis as the sourcetype , the fields are extracted as I'd expect. (The uploaded file gets tagged as iis-3 FWIW.) Why are the Universal Forwarder logs being handled differently and how to fix it? Thanks, jon ... View more

I've read through the docs and come up with a simple test config: st1: Deployment Server $SPLUNK_HOME/etc/deployment-apps contains testapp , which has defaults/inputs.conf and defaults/outputs.conf $SPLUNK_HOME/etc/system/local/serverclass.conf has [serverClass:testapp] [serverClass:testapp:app:*] filterType = whitelist whitelist.0 = st2 restartSplunkd = true splunk list deploy-clients shows Deployment client: ip=172.16.111.129, dns=st2, hostname=st2, mgmt=8089, build=98164, name=st2, id=connection_172.16.111.129_8089_st2_st2_st2, utsname=linux-x86_64 utsname: linux-x86_64 name: st2 ip: 172.16.111.129 hostname: st2 build: 98164 dns: st2 mgmt: 8089 phoneHomeTime: Thu May 19 09:13:22 2011 id: connection_172.16.111.129_8089_st2_st2_st2 st2: Deployment client $SPLUNK_HOME/etc/system/local/deploymentclient.conf contains [deployment-client] clientName=st2 [target-broker:deploymentServer] targetUri = st1:8089 st2 never gets testapp deployed to it. I've had a support ticket open for 8 days on this with no luck. What did I leave out? Thanks, jon ... View more

This morning I see the dreaded license exceeded message on one of my indexers. Curious as to which host caused it, I run index=_internal source=*metrics* group=per_host_thruput earliest=-1d@d latest=-0d@d | rename series as host | eval MB=kb/1024 | stats sum(MB) as MB by host The numbers don't appear to add up, so I'm suspicious. I run a grand total index=_internal source=*metrics* group=per_host_thruput earliest=-1d@d latest=-0d@d | eval MB=kb/1024 | stats sum(MB) as MB And yesterday's total is 131 MB below my license limit. The day before was was more than 300 MB below. In fact index=_internal source=*metrics* group=per_host_thruput earliest=-10d@d latest=-0d@d | eval MB=kb/1024 | timechart span=1d sum(MB) 1 4/23/11 12:00 AM 179 2 4/24/11 12:00 AM 169 3 4/25/11 12:00 AM 334 4 4/26/11 12:00 AM 464 5 4/27/11 12:00 AM 389 6 4/28/11 12:00 AM 394 7 4/29/11 12:00 AM 333 8 4/30/11 12:00 AM 186 9 5/01/11 12:00 AM 176 10 5/02/11 12:00 AM 369 I have 2 license violations listed in this timeframe: yesterday and 4/26. This indexer's license is 500 MB. Am I looking at the wrong data? What is the license system basing its count on? Thanks, jon ... View more