I have the following from a client: I was about to make is for a new AD group “Splunk_CAPS_CAS_Payments” so that they are restricted to data that come from the source logging files //LOG_CAPS_CAS_PaymentEDMS//CAPS//CAS_IN_msg_prod.log and //LOG_CAS_CAPS_InvoiceGL//CAS//CAPS_IN_msg_prod.log Is this possible? These users would only be able to pull the logs from the one CAPS_IN_msg_prod.log. How can this be done? ... View more

I have a new client that has files named as follows: xxxx.xxxx.log Splunk is not ingesting them. How can I ingest logs that have that type of naming convention. I believe splunk is only looking at the xxx.xxx and can't match it to the /*.log stanza I have in the inputs.conf. ... View more

I have been asked to install the puppet viewer application into our clustered environment. Reading the install information, it appears that it's speaking about a non-clustered environment. What would be the instructions in a clustered environment and how can I make sure that pushing out new apps from my deployer to the search heads doesn't overwrite anything. ... View more

I am receiving the above error when trying to deploy update and new apps from the Cluster Master to the Indexer Cluster. The aspps do exist in /web/splunk/etc/managed-apps directory structure on the cluster master, but I still get this error. I have reviewed several Answers and none of them have worked for us. Recently we worked on the indexes.conf to standardize some features, I'm wondering if that may have caused it. All we did was remove The repFactor-auto from each index (there are about 35) and put it in the [default] and also removed the maxTotalDataSizeMB from each of the index configuration and put it in the default stanza. Now when we push a bundle, we get the Failed to install app with the application does not exist. Would really appreciate any assistance you can give me. ... View more

My customer has some very large csv files that are only updating about 200 events/rows of the data into Splunk. "As per checking MDMS-001_Meter Reads Requested file have 4,633, but in Splunk it only have 208 events. " How can I get the entire csv file to upload? I am using universal forwarders for the ingest. ... View more

Clients wanted a change in how there data was displayed using the sourcetype they first used. How do I remove all of what they have currently indexed so we don't get duplicate entries? ... View more

Clients are saying they are only seeing 2 days worth of the logs. [name] homePath = volume:primary/name/db coldPath = volume:primary/name/colddb thawedPath = $SPLUNK_DB/name/thaweddb frozenTimePeriodInSecs = 15780000 maxWarmDBCount = 300 maxHotSpanSecs=7776000 maxHotBuckets = 3 maxTotalDataSizeMB = 75000 repFactor = auto ... View more

I have been trying to load into my distributed Splunk system the Templatef for Citrix XenDesktop 7 application, but I am unable to get the home page to display when I click on the DropDown by Dashboards. Instead I get a 404 message. Were there other conf or xml files I need to update to get this corrected? I used my Deployer to send out the app to the search heads. I did not include the forwarder folder(s) with this push from the Deployer, only the application. With our enviornment and the way we do indexes, I also removed the indexes from the application and put them in our global indexes application. ... View more

I have been asked to load XenDeskop for a new client. I have been reading through the documentation, but I'm not certain which Splunk backbone servers that the app needs to be loaded on. Also, do I need to create an index to be able to separate this customer from other customers? I am on Splunk 7.2.6. ... View more