Did you restart the Splunk instance? It seems like that's necessary. Also, I would try browsing using Firefox or Safari. I've seen this error before but on IE. Not sure if it's a bug. ... View more

The Splunk for Bluecoat app should work on the free version of Splunk, provided you are not going over the maxed index per day limit, which is 500mb. You should be able to download and install the app from splunkbase, but you will be required a valid login, which is also free. ... View more

Did you do the Splunk for Cisco Security app or the Splunk for Cisco PIX or both? I would suggest maybe a restart of your Splunk instance and see if that helps. My understanding is that the Splunk for Cisco Security app does NOT support the PIX appliance, so you might be better off getting the Cisco Firewalls app (http://www.splunkbase.com/apps/All/4.x/app:Cisco+Firewalls) if you're getting logs from a PIX. This should help: http://answers.splunk.com/questions/3366/how-do-i-install-the-cisco-firewall-add-on ... View more

You can also go back to the configuration files (*/etc/system/local/savedsearches.conf) which should contain all your saved searches. You can then directly modify the search (if you know the search string) or remove the entry from the config file. You might need to restart Splunk after the changes. Here's the documentation for the savedsearches.conf file: http://www.splunk.com/base/Documentation/latest/Admin/Savedsearchesconf Also, the User Manual is neat and informative but you can also find more "admin-related" task on the Admin Manual. I would give that doc a glance: http://www.splunk.com/base/Documentation/latest/Admin/Whatsinthismanual This will give you more ammo in configuring the backend side of Splunk. ... View more

Maybe try and re-add the monitor? Remove the monitored directory and then re-add it. ... View more

Try (?msi) instead of just (?m) ... View more

If you starting seeing "**-too_small" it means that the indexing is being learned, and not using your props.conf or transforms.conf settings. So, a couple things: First, you shouldn't replace any of the documents/configuration files within the Default folder. Use either the Apps folder or the Local folder for your custom config. Second, there are a few bugs in the past (true with IIS at some point) that no matter how you specify the sourcetype, it will only grab the name, and learn the rest automatically. So that's something that needs to be fixed on the software. Third, when you re-add/re-index, make sure you clear the learned configurations. This is located on the Apps folder under learned. ... View more

This might also help. http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage You can tweak the xml to your needs. ... View more

This was actually solved by re-creating the profile for the IE user. This sounds convoluted but Splunk was installed on a server and being hosted through Microsoft's RemoteApp. So essentially, the profile is created on the RemoteApp side, therefore showing the same error regardless of which user is logged on. Needless to say, to has been resolved. ... View more

My understanding is that it fully replaces the local/inputs.conf that you may have, meaning it does not append the current inputs.conf. My suggestion is to have your custom inputs.conf in an app folder instead, so there's no replacement, or create an inputs.conf on an app folder from your deployment. ... View more

There is no minimum rights, other than the right to install the forwarder. Make sure that you configure the splunk install as a forwarder so as to have the least footprint possible. ... View more

This is happening on 4.1.3. ... View more

Actually in my experience, CSV files, even if you specify the sourcetype, gets auto-learned, and the fields are not extracted. I find this true up until version 4.0.11. I haven't had a chance to upgrade to 4.0.12. ... View more

The one thing you may want to consider is conflict on port usage. Is the server you're running splunk in uses the port 8000 already? I would look into the splunkd.log file to see if there's any error. A restart might be necessary to do a clean re-install. ... View more

You can use the SSOMode. http://www.splunk.com/base/Documentation/4.1.2/Admin/Usesinglesign-onwithSplunk ... View more

Here's the manual for setting up fschange: http://www.splunk.com/base/Documentation/4.1.2/AppManagement/ConfigurationMonitoring I understand that there's a PCI compliance module in the ESS Suite, which is not free. ... View more

Unless you really need a local copy of the documentation for Splunk, the online version should be more than sufficient for documentation: http://www.splunk.com/base/Documentation ... View more

You can easily move buckets either through attaching a script each buckets or make a pointer to the storage of the cold folder/repository on the indexes.conf. ... View more

Mine just went away over time. ... View more

This is something I am trying to accomplish altogether by creating my own app with saved searches. This helps seggregate the correlated data I want/need while making it easily accessible for all other parties. The app piece is purely optional, but when you do a saved search, you can kick off a script or an alert, base on your own choosing. ... View more

This is still not working/unable to recreate. Should I raise a white flag already? ... View more

I'm seeing this on IE only, mostly when you browse on the actual server where splunk is installed, winserver 2008 R2. ... View more