We will need to restart splunk in order to reflect configuration changed by CLI. Did you restart splunk after changing props.conf? And the configuration affect new coming data, not indexed data. ... View more

My suggestion is certainly rough, but it could be kind of guideline. I hope this will help something. ... View more

No, I have never seen the same issue when my configuration is correct. Did you confirm if LDAP group and user role of splunk are mapped correctly? I recommned you if your configuraiton is everything correct. ... View more

Daily volume less than 800MB is supposed to be small enviornment. In genral, splunk need high disk io to get search result faster. As for Xeon L5609, clock size 1.86 GHz is not fast. Are you using recommened server suggested by splunk? Please see as bellow. http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdeployment In typical, you do not need second splunk instance when daily volume is less than 100GB. In your case, you may need to upgrade your hardware spec CPU and DISK in order to make search faster. Please verify your environmnet. ... View more

Splunk forwarder can forward data to splunk other instance or third party software like syslogd with text format. I do not think splunk forwarder can foward data to mysql. you will need to make script to geta data from splunk and put into the mysql. ... View more

Timestamp is recognized when Splunk parse the event. So, you will need to configure appropriate Timezone setting on your universal forwarder with host, not central indexer. Hope this help. ... View more

We can configure how splunk treat event break. Please refer to the link as bellow. http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents By default, splunk break event with timestamp that splunk can recognize. The setting is "BREAK_ONLY_BEFORE_DATE = true". I do not know your apache log format, but there is possibility that splunk can not recognize timestamp of your apache log so that splunk can not break each events properly. ... View more

If you want to store more data onn your indexers, you need to increase the disk space. Otherwise, you need to erase data in order to keep available disk space for indexing new data. ... View more

Can you confirm if firewall of your platform is disabled and splunk is listening with udp:514? ... View more

Splunk can index any data with text format, not binary format. You will need script to collect data of relational database like MySQL. Following app can be helpful to collect data from MySQL, but you will need to customize it according to your requirement. http://splunk-base.splunk.com/apps/41769/splunk-mysql-monitor ... View more

I think it depends on how you configure regex. Following is just example configuration in props.conf. [your_sourcetype] EXTRACT-example_field1 = (?i)TIME:\s(?P \d+)\s+ EXTRACT-example_field2 = (?i)FileNet Time:\s(?P \S+)\s+ EXTRACT-example_field3 = (?i)OnBase Time:\s(?P \S+)\s+ ... View more

It's strange. Please clean event at all, then try to re-index the file. ... View more

I think I can index your timestamp of the file by default setting. How did you log the snmptrap to the file? Does the file contains the timestamp as you described? ... View more

I have seen similar issue. I will share my case, but not sure if this help. I saw "linecount" field in left pane of search result, then there were some value "2" or "3". It means splunk accidentally indexed event with wrong break. Could you confirm if this is your case? ... View more

I do not have solution for such case. You may need to contact splunk support. ... View more

If the search running in splunk console is fine, did you check earliest time and latest time? If both time is same as you did in splunk web console, you will need to case open to splunk support. ... View more

If you are going to forwarder, you can use helpful function of deployment server and client in order to share any configuration files. But I think copying the indexes.conf to the new index server is the easiest way to achieve it. Otherwise, you can use rsync command on linux server. ... View more

The minimum size that you can specify is 1MB for the disk space. Is this solve your problem? I do not think there is any command to disable the check since this is important check for splunk. ... View more

If you change your props.conf, it will not affect until you reboot splunk and re-index the data. And you do not need "LINE_BREAKER" setting when "SHOULD_LINEMERGE=false". ... View more

Do you have plan to support Splunk 4.3 in future? ... View more