Generally you aren't likely to get a reset license for a free version of Splunk, the best way to bypass the violations is to backup your indexes, delete, reinstall and copy the indexes back over. ... View more

While you're editing it, you should click the tick next to your answer to accept it 🙂 ... View more

I'm sorry but if you're running a technical product like Splunk then you can't just discount all previous answers as being too technical. Read up a bit and learn how to manage and administer Splunk so you do understand in better detail. In regards to both your problems, do you start and stop it when needed? Indexing a large number of Windows events can take a fair bit of time and cause congestion on a slow disc, I expect that is the case here. Also if you have any level of auditing enabled on Windows this can also cause a fair bit of noise. 156meg (if i've read that right) isn't particularly big for an internal index, this stores all internal splunk related logs. Have you tried searching _internal for the word error in case there are any system problems? Jobs expiring or getting cancelled could be a sign of high IO or CPU usage, install the Splunk on Splunk (SoS) app to get a better insight into the performance of your system ... View more

What version are you running? Have you checked splunkd.log for errors? ... View more

Well, what it actually does is gets the configured address of the Splunk server and launches the browser but it doesn't start Splunk if its not running. Admin user or not, the only way would be to run splunk start or via the services menu. Is it just to read Windows event logs? Running on a non admin machine it will eventually need to be switched to a free licence, at this point it will provide unsecured access to the logs it has consumed. Also each time you start it there is likely to be a drain on system resource as it indexes all new events ... View more

Well, at a first guess without any testing you've removed the _time field by using the reporting command table to only pass those two fields. Each time you pipe results over, reporting commands will only pass the fields you tell them to. Try adding _time to your commands and please please please read the tutorials ... View more

ndgracs\d+\.dom1\.dom2\.com should do the job, although it would need testing 🙂 I can't recall how exacting it is at index time, perhaps ndgracs(\d+\.|\.)dom1\.dom2\.com ... View more

Well this is a rex statement so you'll want to use something like \d+ which means match a number and the plus means keep consuming the characters until the number ends ... View more

how about if you just create the one stanza to rule them all? Using a regex like temp\d+.domain1.domain2.com? ... View more

Are the both arriving via the same source? ... View more

this might be a silly question but is it just a mistake where in props they are both .com and in transforms one is .gov? ... View more

try ./splunk cmd btool inputs list --debug This will produce a list of all stanzas and before each line will be the name of the app it is defined within to help you track those pesky hobbit... configs down ... View more

Uh... its probably the most descriptive error you could receive... did you check what user it was running as? did you speak to whoever started it? did you start it as another user? I would avoid everything after the second sentence on MHibbins answer, you just need to stop it with the correct user - anything else could, as he says, cause WORLD ENDING PROBLEMS. 🙂 ... View more

Ayn: Check your email! Splunkppornima: Did you try the search condition instead? Also, all of what Ayn said. You really need to go and learn how to debug these problems to run Splunk effectively ... View more

I suspect it may be that the IO on the system is becoming overloaded and causing Splunkd to become unresponsive. What the current average queue sizes your system is experiencing and the peak CPU load over busy periods? ... View more

| where duration==$duration$ ? or perhaps | search duration=$duration$ ... View more

Well you could've given me a +1 at the same time 😛 ... View more

You may be able to use http://splunk-base.splunk.com/apps/64133/office-documents-template-system-odts-for-splunk Although I'm not sure how much you can automate the process, also you would need to have a draft sent to yourself first for you to add your comments or details. ... View more

Just as a twist on this, I generally take some example data and build a data generator from it. This is perfect for testing without waiting for events to happen and gives you an on-demand pool of data when you require it. ... View more

We can do it! Just believe in yourself and you'll find me! Note to self, don't log out on this laptop... ... View more

and default user of admin ... View more

Before you try any of that, just check if you have port 8000 allowed through your firewall. Its the usual culprit, also check that Splunk is actually started 🙂 ... View more