We have some Cisco devices that are sending syslog via port 514 natively (no splunk forwarder installed, obviously). I want to be able to send this log to a certain index, based on hostname. I tried using props and transforms as the following: Since the original log from the Cisco device isn't coming from a Splunk forwarder, do I have to regex for the hostname? props.conf [host::hostnameommitted.com] TRANSFORMS-force_index_for_your_host = force_index_perimeter transforms.conf [force_index_perimeter] REGEX = . DEST_KEY = _MetaData:Index FORMAT = perimeter Thanks! ... View more

Hello, In working with Splunk on an H.A. solution, we came up with the following. We would take all events into one indexer (A), then (A) would forward all of its events into indexer (B). We didn't want logs load balanced between both indexers, so we went with this setup. I attempted to configure this by setting up receiving on (B) and configure forwarding on (A). However, when I do this, it looks like all data stops being collected on (A), and (B) never receives anything. I configured (A) to keep a copy of all logs to be forwarded, and I created a couple of the same indexes on (B) to test and make sure this would work. Any help would be greatly appreciated, and thanks! Alex ... View more

This is the search I am running. I use this search in a dashboard with a single value, color coded: index=internal source=*metrics.log group=per_index_thruput series!=* | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB) | rangemap field=sum(totalGB) low=0-13 elevated=13-16 severe=16-9999 default=None I want an alert to fire if sum(totalGB)> 8. This is what I am trying to use in the "if custom condition is met", but I cannot get the alert to fire: search sum(totalGB) | where sum(totalGB) > 8 Any help is greatly appreciated. Thanks! ... View more

I have the following coming in through the *NIX df script. The formatting is lost in this form, but it comes through in a column and row format, as if it was being run from a *NIX command line. Filesystem Type Size Used Avail UsePct MountedOn /dev/sda9 ext4 19G 699M 18G 4% / none devtmpfs 5.9G 256K 5.9G 1% /dev /dev/sda1 ext4 184M 51M 124M 29% /boot /dev/sda5 ext4 46G 369M 44G 1% /var /dev/sda6 ext4 156G 338M 148G 1% /home /dev/sda7 ext4 138G 1.5G 130G 2% /opt /dev/sda8 ext4 184G 3.8G 171G 3% /usr /dev/sdb1 xfs 26T 644G 25T 3% /logs I want to extract the "Used" value in the xfs line to report on and chart. It looks like that field extractor wizard is not available for this source. I was playing around with the "rex" command in my search, but I couldn't get anywhere with that, either. Any help would be great for this rex noob! Thanks! ... View more

We have the *NIX app working, and as an example, we have one system feeding netstat and open port data into it. We are feeding this data every hour. How can I send an alert if the reports each hour don't match? Basically, if a new port is opened, or an existing port is closed, we want to get an alert. Thanks for the help, as always! ... View more

I'd like to create a role in Splunk that gives access to one device's logs only instead of an entire index. Is this possible? Thanks! ... View more