USER isn't defined in your script, so there's no value to replace for ${USER} . Did you attempt to use splunk enable boot-start -user <splunk user> to accomplish this, or some other means? ... View more

| fields needs to go in the base search, not the post-process search (which is where you have it above).' Apologies for not seeing your comment about trying the fields method already. ... View more

Set max_match to have rex return multivalue fields: | rex max_match=0 "^(?:[^,\n]*,){8}\"\w+\":\"/(?P<apiURL3>\w+/\w+/\w+/\w+\.\d+/\w+\.\w+)" ... View more

One common solution is to define your indexes in an app, and track that app in some form of version control. This allows you to deploy and update indexes.conf quickly and easily to both your indexers (or cluster master) and your search heads. ... View more

You show app_source as the stanza for your props.conf. Is that reflective of the source or sourcetype of your data? If the former, it should be source::app_source instead, as per props.conf: <spec> can be: 1. <sourcetype>, the source type of an event. 2. host::<host>, where <host> is the host, or host-matching pattern, for an event. 3. source::<source>, where <source> is the source, or source-matching pattern, for an event. 4. rule::<rulename>, where <rulename> is a unique name of a source type classification rule. 5. delayedrule::<rulename>, where <rulename> is a unique name of a delayed source type classification rule. These are only considered as a last resort before generating a new source type based on the source seen. ... View more

The solution described is described as being specific to KV_MODE=auto (or auto_escaped). I have had this same issue with props/transforms-defined extractions. I haven't attempted setting this field and seeing if it changes the behavior I've seen, though. ... View more

Check out syslogSourceType in outputs.conf: syslogSourceType = <string> * Specifies an additional rule for handling data, in addition to that provided by the 'syslog' source type. * This string is used as a substring match against the sourcetype key. For example, if the string is set to 'syslog', then all source types containing the string 'syslog' will receive this special treatment. * To match a source type explicitly, use the pattern "sourcetype::sourcetype_name". * Example: syslogSourceType = sourcetype::apache_common * Data which is 'syslog' or matches this setting is assumed to already be in syslog format. * Data which does not match the rules has a header, optionally a timestamp (if defined in 'timestampformat'), and a hostname added to the front of the event. This is how Splunk causes arbitrary log data to match syslog expectations. * Defaults to unset. Try setting syslogSourceType to the sourcetype of your non-syslog data so Splunk will assume it is already in syslog format (even thought it's not). ... View more

If you have the DHCP/DNS info also stored in Splunk, you could make use of it in various ways to meet your needs. Here are two I can think of. A. You could run scheduled searches against the DHCP/DNS logs to append to a time-based lookup file, which can be referenced for your sourcetype to perform the lookup at search time for your other data. This could potentially grow rather large over time, and may be better suited to a KVStore. B. You could do some kinda tricky logic at search time to associate DHCP/DNS logs to other events. This may be fairly complicated (it was when I tried, at least), but theoretically is possible. This may be easiest if you can find the logs you want, then apply the DHCP/DNS search to it. ... View more

What options are available to send the data to the 3rd party? Would it be enough to run reports that email csv files? Do you have to send specific bits of raw logs to them via syslog? ... View more

Have you looked into Modular Inputs? ... View more

Have you checked out the existing Splunk documentation for this? http://docs.splunk.com/Documentation/Splunk/6.6.1/Security/SetupuserauthenticationwithLDAP ... View more

You probably want to specify sourcetype in your monitor stanza, creating new stanzas as necessary. You can use a TRANSFORMS action in props.conf to accomplish this, but for your needs I don't think it should be necessary. Look at inputs.conf for how you can use .. and ... with wildcards to accomplish what you need here. ... View more

Are the dashboard and props.conf (in which you defined the ALIASes) in the same app? If not, you may need to alter your metadata for the app which defines your ALIASes to export its props to all other apps. ... View more

On the License Master, there is a report you can view to see the license usage split by various methods. For "by indexer", look at: Settings -> Licensing -> Usage Report -> Previous 30 Days -> Split By (select Indexer) Edit: I see now you need to find the IP address, and not just the identifying information the indexer makes available. You may try looking at active TCP sessions to your License Master on port 8089. If you're on Linux you could run netstat -aln | grep 8089 (replace netstat with ss for some newer distributions of Linux). ... View more

1) Which props/trasnforms files you alter may depend on your other configurations. You can use btool to ensure the configurations you create are being handled as you want them. 2) That depends on what sourcetype the data is created with. When you search for this data in your Splunk instance, what do you see for the sourcetype? 3) You should not need to re-index, but you should at least perform a debug/refresh (yoursplunkhost:8000/debug/refresh, and click the button that is shown there) to inform Splunk to re-read its configuration. ... View more

Does the index already exist? Also, is there a reason you want to use collect instead of a scheduled search with summary indexing enabled? ... View more

Check out custom search commands. It seems you could use them to accomplish what you need, perhaps with a search like: <ticket search> | <your categorization logic> | <yournewcustomsearchcommand> We also use ticket data within Splunk, but we use a custom search command to fetch the ticket data at search time, instead of indexing it in Splunk. ... View more