What do you mean? You need an input to define what is input to the forwarder and you need an output to define what is output to the indexer. If read the link I've pasted above you'll have a good understanding of how they work and how to configure the outputs, the inputs are identical to the indexer configuration so just use what you should have learnt from the main Splunk tutorial to build that. ... View more

From the detail of your question, you're probably best starting here; http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving ... View more

The problem here is what your definition of what alerting really is. To me alerting can only be useful if it is structured and regular, what use is there to be alerted about something... when you go look for it? Thats kind of after the fact. If you had used a scheduled search to look for this alert factor then you may have been notified an hour or two prior to you discovering it. You could generate your own alert by writing a custom search command or running a search against an external script. Perhaps even by using outputlookup to generate values in a lookup that are checked by an external script run on a cron schedule - but it rather seems to defeat the point of alerting, surely? ... View more

When you say timeout, where is it timing out? Is it when the setup is loading, does the loading bar even show or does it just appear to do nothing when you try to run the install? ... View more

Someone downvoted your answer on your question, I upvoted it again to return the balance to 0 🙂 If someone genuinely answers a question or explains the cause then regardless of if someone did it by mistake, you can't downvote it as a bad answer... because its the answer! Anyway, rant over, nothing to see here... ... View more

You would set the sourcetype in the inputs.conf and then reference the sourcetype in the props on the indexer to handle the linebreaking. ... View more

Well, you should be able to answer that by the fact that you may have some dashboards showing some data. Even so, the best part of this app is its ability to collect and collate multiple sources of AD data by running powershell scripts on the remote machines, ldapsearch commands and the like. This helps to enhance the data and give you what you need. Otherwise you may just be better off building your own dashboards to view your log data. I've added the app tag as Adrian might spot this and be able to expand on this ... View more

No, parsing isn't handled on the UF. I've got the internal queue doc here listing its processes. It does have a parsing queue for windows events but thats a special exception. The only props configurations it will handle are for CHARSET, NO_BINARY_CHECK,CHECK_METHOD and CHECK_FOR_HEADER (depreciated in v5). EDIT: From the public docs, http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Introducingtheuniversalforwarder. The universal forwarder does not parse data. ... View more

Are you sure any parsing is actually being done on the forwarder? If you are using a Universal or Light forwarder then they don't actually do any parsing, the parsing is all handled by the indexer so what you may be experiencing is actually the normal behaviour, even if it isn't what you expected 🙂 Define all your parsing requirements at the indexer. Just define your inputs.conf on the universal forwarder and let the indexer handle the rest. ... View more

Just to extend on Ayns comment and in anticipation of you not giving us enough detail... what are you trying to open? How are you trying to open it? What version of linux? What user are you running Splunk under? What port is it trying to run under? Did it give any errors when starting? What is 6 multiplied by 6? ... View more

Why on earth would you downvote an answer someone posts which explains the solution to their problem? Glad you got it sorted ... View more

right and as it says, the splunk instance that is a master node must perform only that single role ... View more

Why do you post with so many usernames? ... View more

How will it kill the box? this is how you do summary indexing 🙂 If you are talking about the backfill then you don't have to backfill at all, if you did want to you could set it to one search and leave it overnight ... View more

Read the first paragraph which says what its in, the version its in and even has a link to get it... pretty detailed ... View more

If you install the Splunk on Splunk app it provides a helpful shortcut and dashboard to view crash logs which you can then send onto support with a diag if it doesn't appear to be anything preventable or caused by any local factors 🙂 http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk ... View more

Just to second this, our customers would normally use another tool for app performance (its not really Splunks strong point) but use Splunk for the analysis and reporting - its real strength. ... View more

To offer an alternative to the right Honourable MarioM 🙂 Just run it after midnight for the previous day, every day. To create your first set of data just run the backfill script to populate your index with the last X days of data and from then on it will update each night. Usually I run SI searches for the previous day at around 1am just so I'm happy all events have arrived and because its a nice round number 🙂 E.G. Each night run this for the previous day; sourcetype=xxx earliest=-1d@d latest=-0d@d | dedup record.incidentId|sistats count by record.priority record.groupArea record.assignmentGroup record.groupDepartment record.affectedCI Backfill with; ./splunk cmd python fill_summary_index.py -app APPNAME -name "SAVEDSEARCHNAME" -et EARLIESTTIMEMODIFIER -lt LATESTTIMEMODIFER -j 2 -owner SEARCHOWNER It will prompt for user details when run and the timemodifers are the usual splunk ones, to backfill for a month you can use -et -1mon@mon -lt -0d@d <-- I say one day as your new scheduled search will pick up the current days events when it executes. The -j flag sets how many concurrent searches it runs, I have put 2 but you can increase this if you have the spec and its not a busy box. ... View more

Ah, I missed that. It becomes a little more complex when you want to do that, from memory I believe the only way is to run a separate apache server with a certain module enabled. Someone with experience of this might post a better answer 🙂 ... View more

You can do it with IPTables, a quick Google threw up this; http://forum.slicehost.com/index.php?p=/discussion/2497/iptables-redirect-port-80-to-port-8080/p1 Looks like the command you need 🙂 ... View more

Switcharooed to an answer ... View more

The most important thing to remember is that when you pipe to a command you pass the results of the previous command over, so if you do a statistical command that strips away the time element then you cannot do anything against time in the following commands (well, unless you do some other magic but lets not overcomplicate at the moment 😉 ) Good luck! ... View more