Suppose I splunk a file and it is gzip'd on disk under the appropriate Splunk index directory. Then let's say I conduct a search for some of those splunked events. Will splunk read the events directly out of the gzip file into memory, or will it expand out the gzip file somewhere else first and THEN read them? If so, where on disk is expansion taking place? Also, once Splunk reads the events from the gzip'd splunk file, does it write or cache any or all of those events out to disk temporarily and, if so, where and how long do those artifact stay around? ... View more

Is there a way to report on the position of an event relative to the rest of the events in the result set? For example, if I have five events in my result set, is there a way to display each event along with the position number relative in time to the other events, kind of like showing the ordering or row number? Like this: User     Row_Position ---- ------------ Eric     1 Greg     2 Gerald   3 Ledio    4 Mick     5 where the event containing the User=Eric is the earliest in time, the one with User=Greg is second one in time after that one, the event with User=Gerald is the next event in time after that one, etc. BTW, when I create a table with my search, I notice a grayed-out row number on the far left side of the table in the search results page. Can I reference that? If so, what is the name of that field? ... View more

I have Windows Security events that tell me when a user logged on and I have an ActiveDirectory event that tells me that an OU object was deleted, but I cannot figure out how to correlate the two events together without a common unique "id" field (value) to link them. Is there a configuration within AD or within Windows that will log some sort of common ID or GUID to both events so I can use tie them together into a "this person deleted this OU object" in a report? Or, am I out of luck and maybe there is some search that will get me close to correlating these two semi-related events in such a way that I can get an approximate report along these lines? ... View more

How often do the Splunk software product and patch maintenance releases occur? Is there a standard schedule for them or some consistent frequency that be expected for the various releases? ... View more

So far, my searches are within reason, lengthwise, but I have a few that are pretty long too. I know I can create macros to abstract out common parts of my searches and, essentially, cut down on length of any search string in the Search GUI, but even then, wondering if there is a maximum limit on characters allowed in a single search string that gets executed. ... View more

I plan to setup Splunk Forwarders to push Windows Events and also some linux events to my central Splunk indexer. Need to know what the minimum network bandwidth pipe is required for this? ... View more

I intend modify my app/script so that it will write out a completely custom log file format for Splunk to monitor and index in real-time. What is the best, most optimal format to use for my custom log event such that Splunk automatically extracts ALL of my fields and the timestamp and I do not have to setup or configure any field extractions myself. ... View more

Regarding agent vs agentless data / event gatering, WMI (agentless) seems easier to setup from within Splunk to pull in the data from remote Windows servers. So why would someone deploy Splunk as a Forwarder (agent) on their Windows servers to push the data in? ... View more

I intend to install Splunk as a forwarder on my Windows boxes, but I only want Splunk to monitor for the very latest, most recent Windows events being logged now in real-time and I DO NOT want it to also index all of the historical events that may be logged in the Event Viewer previously. The reason is, when it starts indexing the historical Win Events, it causes the CPU to spike up initially, and I cannot allow that to happen when I deploy it on a new Windows server. Can I configure Splunk on Windows to only index real-time data coming in now and avoid causing the CPU to spike upon initial deployment of Splunk? ... View more