Also you've marked an answer as accepted and voted it up which suggests its resolved your questions 🙂 ... View more

If you follow the links and tutorials I've pasted you don't need to be downloading the SDK's to do anything, just start building the tutorials. ... View more

If you have a look here http://dev.splunk.com/view/SP-CAAADWA it has a breakdown of where each file needs to be placed. ... View more

When you define the crcsalt you define the full path of the file, the actual filename being the same makes no difference so it will still be read ... View more

As the previous answer says, Splunk builds a CRC of the first 256 bytes, in http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf you can edit the crcSalt to include the source path in the CRC check to ensure the same files in different locations get indexed and you could always change the initCrcLength to capture a larger portion of the file if the header changes through the file. ... View more

This doesn't quite resolve the issue of the CRC though ... View more

btool is one of the most useful commands when troubleshooting Splunk, the --debug flag prepends the app that the config stanza is from to the line. You can run it without and it just won't show you the app context. The most powerful part of btool is that it shows you the applied configuration of all config files ... View more

Good luck, there is a JSON example module there which i used when attempting something similar ... View more

You've not really given us much detail here but having a quick stab you could add this to the end of the search that populates it; | fields - e1 ... View more

Or an even easier Splunk-centric way to find this would be to run from the $SPLUNK_HOME/bin directory; ./splunk cmd btool transforms list --debug | grep org-lookup Chances are that the lookup exists in the $SPLUNK_HOME/etc/users/ directory somewhere and it just needs to be made public (although there are plenty of other reasons). It looks like a defined lookup so you could try in Manager and lookups first, it may well be defined in the UI. ... View more

Surely as an information security engineer you know better than to post your full details on a public forum? 🙂 Have you downloaded the Deployment Monitor app? There are other ways to do it but this is a nice quick way to monitor your sources. If a sourcetype is quieter than normal then it will highlight this. ... View more

If you're serious about doing this then head over to; http://dev.splunk.com/view/app-framework/SP-CAAADVF It has tutorials and step by step guides on how to achieve something like this, I did something similar recently with another JavaScript library. Like stefano says, it is not trivial and its not the sort of question where you can ask here for steps, no one else is going to integrate this library for you 🙂 ... View more

If you go to Manager in the top right, click on Apps, then next to Google maps is a permissions box, change the permissions so it exports globally, Not just for this app. ... View more

Just as you would with any other module, put a search upstream from the google maps module with the _geo field being populated. For some good examples have a look at the Google Maps app once installed, it has example dashboards that you can copy and just edit the searches of. ... View more

You don't need to start a new question to continue this one on, in answer to your query, have you read the link I pasted in the other answer? (where you downloaded it from). From those docs; Manual building the _geo field If you don't want to use the geonormalize command or if the location fields do not match any naming scheme, you can manually build the _geo field. Example: eventtype=phone_activation | eval _geo=phone_loc_1+","+phone_loc_2 (Assuming that phone_loc_1 contains the latitude and phone_loc_2 contains the longitude) Basically, the app uses a _geo field to build the coordinates to plot on the map, follow the instructions above to build this manually for your query. Also bear in mind that you won't see the field appear if you test it in a flashtimeline as _ fields are hidden. To test it you could do | eval geo=... to make sure its building the right field first. ... View more

You could use eval to add them in manually at search time; | eval user="*".user."*" ... View more

Oh you've probably completely botched it by copying folders around like that. It depends how those folders were originally created, the user you copied them with, the user that was used to start splunk. Just install from fresh and re-upload your custom apps. ... View more

Restore from a backup. As far as I can tell they've actually been deleted so short of data recovery, you've just got backups to fall back on. I have a support case with Splunk and will update if anything more comes back, for now just stick to tar upgrades ... View more

What problems have you had in particular? The detail in the summary page and in the example dashboards with the app are all really clear and its one of the easiest apps to get installed and get started with 🙂 (its been around a while) http://splunk-base.splunk.com/apps/22365/google-maps ... View more

Well I never... I take it back, it turns out that running an upgrade will delete files from another instance... I have three instances on one machine. Two instances were running, I ran the upgrade against splunk1 whilst splunk1 and splunk2 were running. The upgrade successfully upgrades splunk1 to the new version, splunk2 however was deleted with only etc, lib, share and var remaining... Looks like it may be an unintended side-effect of the RPM install process, I suspect its not just working off the prefix and is doing something funky with the running processes. Anyway, in summary, yes. It is all your fault that your colleagues instance has been deleted 🙂 ... View more

In that case I'd say almost certainly that this is nothing to with the upgrade, something else has deleted those files. You'd need to look at other things on the system but this isn't a Splunk issue. Also you are missing an includes folder and I don't recognise the infa directory, something else has happened here. ... View more

Ayn is trying to help below, you're best replying with actual detail and problems to his responses rather than starting a new question each time you have a reply 🙂 ... View more

Lets just be clear. You have two instances. Installed to completely different folders? e.g. /opt/splunk1/splunk/ and /opt/splunk2/splunk (by default the prefix term on RPM will still install to a splunk directory in the target). So splunk1 and splunk2 work perfectly. you run an upgrade pointed at splunk1. It works, but you suddenly discover that half the files from splunk2 are deleted? ... View more

well an upgrade wouldn't have deleted files arbitrarily from another instance. I think you might have something else going on here or you've made a mistake somewhere else. ... View more

From previous experience, this is an impossible solution. Best way to calculate is to setup Splunk and turn on the taps for a week, although its noble of you to try 🙂 Some things you can't estimate (or could but the calculator would be so complex it would be quicker to do a PoC); Natural spikes in data activity you may not currently be aware of (Hot desking impacts switches, user logons, backups etc) Number of users and their roles. A count of users tells you nothing but dependant on their role or group access they may be generating more events by accessing more resources. Also an admin level user may generate more system, security and application events. You ask for average data size a day but how do you assess this? Some systems will only allow you to output syslog over UDP which you couldn't estimate without sticking a syslog server or Splunk on the other end... by which point you know your licence needs 🙂 Bob has a windows 2003 server, its a DC. Phil has a windows 2003 server thats also a DC. Oh but Phil has more audit options turned on, but less users and Bob has a massive network but did a pretty poor job of configuring replication so theres lots of errors. More of the above.. I'm not trying to be negative, its a great idea to try and do something like this but as I said, I've previously tried to build estimates but to build the estimate you need to see the natural flow of data over a week to take into account normal peaks and lows, including the number of times someone may enable debug on a switch (not to mention you may have 20 switches/routers all with different log levels).. and in the end just stuck Splunk in and worked it out in real time. This also gives you the advantage that you can enable some nullQueues and edit your inputs to trim the fat. ... View more