Is there an advantage to using makemv vs using split() eval function? (Other than split() was introduced in 4.1) ... View more

Maybe try using append . As long as have you do something like search1 | append [ search2 ] | stats values()..., by instance could work. ... View more

To be honest, I've never really been able to make join work for me. I guess I keep doing something wrong, but I always find a different solution that actually works, like using transaction , stats , sometimes even loadcsv append=t ... sometimes I use set but that one can be a pain too. Good luck ... View more

Thanks. I figured out my issue. I was doing a date-effective lookup and I stats was stripping out _time . I've updated the post. I am somewhat surprised that lookup didn't complain about missing fields like I've seen it do in other cases, but I suppose there is no single "right way" to handle the situation of a missing _time field, and it certainly makes sense why lookup failed to give me what I was looking for. ... View more

Your indexes are automatically repaired every time splunk is started and that normally takes care of most crash issues. If you have been able to roll back to 4.0.x and splunkd starts up, then It doesn't seem like your issue is with your indexes. In and index corruption scenario (one that isn't not automatically recovered, of course), I would suggest that you open a support case with splunk support, run the splunk diag utility, then attach the generated diag file to your support case and immediately follow up with splunk's support via phone. If splunkd literally crashed, then another approach to digging into what happened is to look in the var\log\splunk folder looking for *crash* log files. They may be able to shed some light on your issue. Of course, the splunkd.log and other logs in that folder, can be very valuable as well. ... View more

The drilldown feature wasn't added until 4.1. You may have this issues with any views (dashboards) that you changed in 4.1 before you went back to 4.0.x. You should be able to comment out (or remove) drilldown option tags. ... View more

Have you tried explicitly monitoring for a single file for a single user? Something like [monitor:///home/someuser/.bash_history] , while this isn't a long-term solution you can at least prove or disprove the usability of this source. Good luck. (Oh, and please post an update letting us know if indexing this info ends up being helpful or not. I'm quite curious.) ... View more

Can you elaborate on what you mean by "an eventtype in combination with a tag"? I tried creating a single "start" eventtype that matched either "Backing up" or "Include files modified" events. Are you suggesting that tagging that eventtype and using startswith=(tag::eventtype=mytag) could make a difference? ... View more

If you haven't done so already, I would suggest explicitly add a TIME_FORMAT in your props.conf file. (Maybe even TIME_PREFIX too.) You don't want splunk guessing timestamps formats and trying to turn your eventId field into a date/time. You also have dates following the term EXPIRY_MONTH that could be picked up as well, so you probably want to nail this down and keep splunk from guessing. ... View more

Greg, looks like we are going to need some more info to help you out. First, do you have ssh access to your hosted environment? If so that opens up a few options. Also, do you care if your log data is sent across the internet unencrypted? Next, can you find out which of these tools you can run on your hosted environment? Check for rsync , wget , and curl . If you can get shell access and run <program> --version you can confirm that they are installed or not. Also, do you know if your provider allows directory listings of your log files? ... View more

geva, this would be a possible replacement for the rsync approach. It's a bit more quick-n-dirty than rsync. However, it may be your only option if your can't run rsync on your hosted system. I assume that Jrodman is suggesting a log pulling approach here, where as rsync could be setup more easily in either push or pull mode. ... View more

No, I don't believe the forwarder can be setup to run via cron. Even if you could rig up something like this, it's probably not a good idea. Running on windows will make the rsync option more difficult (and jrodman's curl or wget ). If you have a local unix setup than you could setup a forward on that machine and forward your events to your central indexer, or you could setup something like cygwin and run rsync or other unix tools on windows directly. The last time I tried "rsync" compiled for windows, I wasn't very impressed; but cygwin should be fine. ... View more

Just a minor correction. I believe Jrodman means wget -c not wget -C . The args are case-sensitive. (This is short for wget --continue , if you prefer the more verbose style arguments for readability.) ... View more

I have one alternate suggestion for example 1 that is less time-range sensitive. Assuming your start and end markers are as clear-cut as they were stated, then you may want to try the transaction command: transaction eventId startswith="################################################" endswith="@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@" Then you don't need the | search endEvent=1 part. ... View more

Yes. A search with sistats (just like a search with plain stats ) needs to setup to enable summary indexing. (The "si" prefix commands don't magically feed any data to the summary index. They are just indented to be more summary-index friendly commands.) ... View more

Just a quick word about set diff option. Don't forget to remove the hidden fields in your subsearch. In your example, instead of just using | fields host , you would have to use | fields + host | fields - _time _raw Otherwise, set will attempt to compare your hidden fields which generally will not work out. ... View more

What is Puppet? Can someone provide a link if this is a recommended tool? ... View more

See this answer: http://answers.splunk.com/questions/1136/splunk-optimize-warning/1139#1139 ... View more

It seems like there are a number of items to address here. As far as I know splunk does not do any special processing or blocking of hidden (or " .* " files). The first think you may want to check is simply file permissions. From within splunk's web interface, you should be able to see evidence of this kind of problem with the following search: index=_internal sourcetype="splunkd" FileClassifierManager Also, a more generally useful approach is to login as the 'splunk' user, and run the the command to see how splunk will process an individual input file. splunk test sourcetype /home/someuser/.bash_history When I try this on my system, for example, and got the message, which indicates a permissions issue. WARN FileClassifierManager - Unable to open /home/someuser/.bash_history. WARN FileClassifierManager - Invalid file: /home/someuser/.bash_history, reason: cannot_read. When I tried this with a file that could be read by the splunk user, then it created a new source type called "bash_history", but looking over the automatically assigned settings, I can tell you that it will not look quite right out of the box due to line breaking. The other issue you will have is with timestamping. My local copy of .bash_history has no timestamps in it, and if I understand how bash works properly, this file is only ever updated when you logout, therefore you will see a number of new entires showing up all at once.... also I don't think this file is "rotated" in standard log fashion, which could cause duplicate entries (I'd have to test it to see). The bottom line is that this probably isn't going to work right out of the box, and I'm not sure it's going to give you want you are looking for. Which begs the question, what exactly are you actually trying to get out of indexing this file? If you want to track user activity, there are other options. Also if this is your only means of tracking user activity, then your users can easily circumvent your means of tracking fairly easily by either messing with .bash_history directly (since they own the file), or my simply running a different shell (zsh, ksh, csh, and so on...). You may wan to check out the ps scripted input in the unix application. That's already setup to capture commands running on the system, and you may find it to be a better option for you. If you really want to get nit picky about whats running, you probably will want to check out the linux audit system. Splunk also has a scripted input for reading files written by auditd . ... View more

Yeah, I'm interested in the official answer to that question as well. But the thought occurred to me that lookups could be a substitute or even an enhancement in certain use cases, so I figured I'd share that with the hopes that it may help you or someone else in the future, even if these commands are re-introduced. But yeah, an official answer would be greatly appreciated. ... View more