Does Splunk support EXT4 file system? According to system requirements, EXT2/3 is supported. Are there any benchmarks regarding iops to EXT4 as compared to, say, XFS? I believe RHEL 5.6 x86_64 fully supports it and it would be nice to take advantage of the I/O improvements it offers, if there is an advantage. ... View more

I would like my Juniper and Cisco network devices to send snmp traps to Splunk indexer running on Win2008. Anyone indexing snmp traps on Windows yet? If so, how are you setting it up? I've seen the Splunk docs referring to net-snmp and also snmptrapd processes, but not sure its made for Windows, so any details would be good to know (for me and I'm sure for others out there trying to send their snmp traps from their network devices to splunk). ... View more

Suppose that I have events for my devices being splunked and each device is associated with an account ID located in a database. We have a scenario as follows: - A device starts out associated with one account (say account “A”) from Feb-March - The device THEN gets re-associated to another account (say Account “B”) in April Reports generated for Feb-March must associate the Account “A” database information with the device, whereas any report after March must associate the Account “B” database information with the device. How would splunk handle this scenario and/or need to be setup to enforce these reporting requirements? Any experience or best practices would be greatly appreciated. ... View more

I've been trying to get a system ready to deploy splunk on several hundred machines in a Linux/compute cluster ... we use RPM and YUM for the base OS installation and I'm trying to get 2 RPMs ready: the stock Splunk rpm -- well, slight modification since the stock RPM deploys into /opt which is a shared/network directory for us --> I'm relocating it to /usr/local/splunk our specific pieces -- our license file, passwd file, and some of the ./etc/apps/ settings (search->inputs.conf and outputs.conf; SplunkLightForwarder -> app.conf) The second rpm seems to have everything it needs, but splunk times-out when I try to start it. Anyone have any ideas why it would not starting up properly? Or maybe a better question is how do you handle this on your large clusters? Even with the deployment server idea, you'd still need to have a second splunk-start process since the stock RPM doesn't fire up splunk, just deploys the files. Or am I missing something? [root]# rpm -i RPMS/x86_64/splunk-client-dscr-4.1.6-1.x86_64.rpm Splunk> Take the sh out of IT. Checking prerequisites... Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Done. Checking databases... Validated databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sample, summary Skipping SELinux check (to enable this check, unset the 'SPLUNK_IGNORE_SELINUX' environment variable). All preliminary checks passed. Starting splunk server daemon (splunkd)... Timed out waiting for splunkd to start. [FAILED] Init script installed at /etc/init.d/splunk. Init script is configured to run at boot. [root]# ps -Af | grep splu root 23294 23016 0 15:01 pts/0 00:00:00 grep splu ... i.e. no splunk processes are running ... View more

I am running the following search in the Splunk Search GUI: * daysago=30 |timechart count| trendline sma(count)as thecount and I am receiving an error in red that says the trendline has an invalid trendline period for argument 'sma(count)' Does anyone know what this means and, hopefully, how to correct? ... View more

Currently, my postgres log events do not contain a timestamp, which makes it difficult for splunking, especially historical events located in .zip files. Does anyone know how to enable the logging of the current timestamp within each postgres event so I can splunk it properly? ... View more

..as in, I have a .cmd or a .bat file that I would like to use as a scripted input. I am not able to find any solid examples of how the script:// stanza within my inputs.conf file looks like that actually works. Anyone do this already that is willing to share their stanza? ... View more

If so, what are you doing with them and/or kinds of useful searches, alerts, reports, correlations are you running against them? ... View more

If so, how? What else can I disable or streamline such that my LWF takes up even less local resources? ... View more

I would like to create a report table where the first column is the time stamp, followed by columns for pid, process, and host, and finally, as the last column, I would like the entire original event as a reference. So the columns will look like this, _time | pid | process | host | _raw Working with timechart command, I find that "values" function does not seem to work, and with the "fields" or "table" commands, I find that they do not recognize Splunk's _time or _raw fields, which means I cannot get the timestamp nor the original event listed as columns in my table. I'm sure I someone has done this, or knows a way to create a report table like I want. ... View more

For the purposes of PCI compliance, has anyone figured out how to monitor changes/queries (containing user CC info) made to MSSQL 2005 (on Windows 2003)? Is there a way to turn on Windows auditing of the MSSQL for this, such that new specific WinEvents are generated? If so, anyone aware of which EventCodes I should search for my PCI reports? Also, what PCI-related MSSQL log files should I be monitoring. (I tried monitoring the .ldf file, but it's binary I think?) ... View more