Right click on the file, properties, click on the Security tab at the top, click edit, from here you can modify the permissions of existing users or add users Be careful about playing around with existing permissions unless its to provide a specific user with permission to a file. Bear in mind that groups can be on here so you could accidentally give a group full permissions instead of a user if they have similar names 🙂 ... View more

Have a look at; http://www.splunk.com/wiki/Community:PerformanceTroubleshooting It sounds to me like you are encountering some performance issues with your install (although there may be something else going on). If there was any information you gather using that link that you wanted to paste here to help troubleshoot then feel free to do so (being mindful of any sensitive information). For some additional info, are these realtime/run-once/scheduled searches? Have you customized your install? E.g. do you use the default index or have you configured your own? Is it just the single indexer for event log data or is it a main server for other forwarders/indexers, if so what sort of setup do you have? Have a look through your jobs window in the top right to see if there are many jobs that are still running and see if their memory usage and time to complete seems excessive. ... View more

This is really more of a discussion topic than an actual question. Definitely something more suited to the IRC channel! That said however, I will provide some URL's to Docu/Wiki pages that help to build a bigger picture. It should be stressed that deployments can vary massively and its quite hard to cover all bases before going in. Not to mention if you are after system specific issues it needs to be remembered that Splunk operates across alot of different network / hardware configurations and it's unlikely that you'll get a coherent response that is useful to yourself. Different parts of a deployment; http://docs.splunk.com/Documentation/Splunk/latest/Installation/ComponentsofaSplunkdeployment Some best practices and good links to other resources; http://www.splunk.com/wiki/Deploy How much space do you need? http://docs.splunk.com/Documentation/Splunk/latest/Installation/HowHowmuchspaceyouwillneed Following on from above, Licensing; http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks Again from above, hardware capacity; http://docs.splunk.com/Documentation/Splunk/latest/Installation/CapacityplanningforalargerSplunkdeployment Considerations for deployment data inputs; http://www.splunk.com/wiki/Community:Deployment_Considerations Backup Policy; http://docs.splunk.com/Documentation/Splunk/latest/Admin/Whatyoucanbackup Data retention policy; http://docs.splunk.com/Documentation/Splunk/latest/Admin/Setaretirementandarchivingpolicy Do you need a hardened install? (Security requirements) http://www.splunk.com/wiki/Community:DeployHardenedSplunk That said, the floor is obviously open to anyone with some good issues 🙂 ... View more

have a look at my updated answer for an example of another way to do it ... View more

Another fantastic site is http://gskinner.com/RegExr/ On there you can test regex on the fly with it updating as you type. I practically live there when doing alot of regex work ... View more

Thumbed up - it relates to Splunk so it certainly shouldn't get a down-vite ... View more

Do you know what the keyword will be in advance? ... View more

I would suspect not but I'm intrigued to know now - hadn't thought of that before 🙂 ... View more

So if you add the line I had in my answer it should forward it out correctly. Make sure that after the blah.blah and the @IP you use a tab as it appears it won't be happy without, and if the text above isn't commented out then just delete it to be safe. Also ensure that the port is open on the indexer side and nothing inbetween is going to potentially block the traffic 🙂 ... View more

I'm slightly confused. Are you receiving UDP and TCP on the forwarder or do you mean on the indexer? I ask as you say you get 55555 on the indexer. Firstly I believe the format should include a colon ":" before the port number, e.g. udp://:33333. That might not make a massive difference however (especially if it looks like its working). Also you need to ensure you have got the indexer setup to listen correctly for incoming data as per; http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Configureyourinputs If you edit the config directly bear in mind a restart will be required for the settings to take effect. If it is Syslog data you want to forward from a server you could always either set the syslog server to forward itself or the UF (Universal Forwarder) to just monitor the log files, e.g. /var/log.... but I am making assuming a syslog link at the end there. If this is no help then please feel free to update your question or comment with more detail 🙂 EDIT: Oh, just saw the other answer, good point - check your firewalls. Sometimes TCP is allowed as it is subject to packet analysis but UDP is blocked by default. (By check firewalls I mean clientside and any hardware firewalls) ... View more

Do you know exactly what version of syslog it uses? Generally speaking (massive generalisation there 😄 ) the following command at the top of the syslog.conf file (which I am assuming may work due to the name of the file) will forward all data out of the default port of 514 (assuming this is the default). *.* @splunk.server.ip.adddress Most syslog servers support adding the :PORT to the end, but hopefully it will just use port 514. Then on splunk you need to configure it to listen on UDP port 514 ala; http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Configureyourinputs The syslog server will probably need a restart after a conf change, if thats no good then let us know what exact version it is and we can change things up slightly 🙂 ... View more

Hey, all you need to do this is at; http://splunk-base.splunk.com/answers/11152/drilldown-link-in-dashboard If you haven't worked in AdvancedXML yet all you need to do is go to the view you want to change to advanced XML and add -> ?showsource=1 This will then display the XML in an advanced form and you can copy it, go back to the dashboard, edit it and edit the xml and paste the advanced version in. ... View more

mcbradford, I don't follow how your last post links to this. If you want to update your question then you need to click on the edit button on your original question, posting replies as answers only confuses matters 🙂 As below, what part of the results are wrong? ... View more

what part of the results are incorrect? ... View more

hmm, see my updated answer ... View more

|top 100 src_ip Change that to; |top 100 src_ip limit=1 | The limit field is part of the top command and can be changed to set how many top results you want to display. Edit: Actually, you probably need to add to the end of your search; | top count limit=1 Edit edit: Ok, how about; index=network source="/u01/noc/log/internetCisco.log" denied |top 100 src_ip | lookup geoip clientip as src_ip | fields client_country | search client_country!="United States" search client_country!="" | stats count by client_country | rename count AS cc_count | top cc_count limit=1 I haven't got Splunk running atm so this is just from memory, it may be a conflict between the counts so lets do a rename and top of that ... View more

no probs 🙂 ... View more

Sure. I believe logging level 6 (Informational) will output connections that are built or broken down. For e.g. Oct 01 10:10:10 *.*.*.* Oct 01 10:10:10: %ASA-6-10212: Teardown TCP connection 5383932 for outside:*.*.*.*/80 to inside:*.*.*.*/1213 duration 0:00:01 bytes 1226 TCP FINs As you can see, the above one includes the total number of bytes for that constructed connection and so by performing a field extraction on that you could build up bandwidth usage, you wouldn't necessarily need to use the CSS (Cisco Security Suite) but could easily build something like this yourself. If you wanted more detail on that then feel free to ask 🙂 ... View more

Are you asking for the apps in a different format? E.g. Zip, rar etc? .tar.gz is importable into Splunk so there isn't really a reason to provide it in a different format. ... View more

If I am understanding this correct. You have an indexer that is also forwarding its results onto another indexer? If so, once it reads them in once it will assign an index to them, when they are forwarded on they will also head into the same index. In that case you need to define the initial index as you did in your additional findings section which would result in them landing in the correct index. Some other parts incase I am off the mark; What version of Splunk are you running? (Indexer and Heavy Forwarder). Do you definitely require the use of a heavy forwarder or could you swap it out to an universal forwarder? This is more lightweight and if nothing is defined it should happily forward onto an indexer and into the specified index on the receiving side. ... View more

Have you added port 514 to Splunk as an incoming port? You do this through "Data Inputs" in the manager view. http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Configureyourinputs Also, I would be tempted to change the address of 0.0.0.0 to possibly 127.0.0.1 or your adapter IP address (there may be issues with your host files or if you have multiple adapters on the machine causing confusion) You also need to make sure that port 514 isn't being blocked by any client or hardware firewall that may be on your machine or network. ... View more