Edited based on your comment that what's important is no longer being prompted to change your password. ... View more

You could do a fresh install, change the admin password, and copy the $SPLUNK_HOME/etc/passwd file contents to put in place (even before installing Splunk) on the image. Also, you can disable the password change prompt by creating the file ( touch it): $SPLUNK_HOME/etc/.ui_login The above tidbit courtesy of a past answers question. It's not actually changing the password that removes the prompt to change your password; it's logging in to the UI the first time. touch ing the .ui_login button will make it seem like you've already logged in. ... View more

Consult the documentation for instruction on setting the timezone correctly. ... View more

You could do all of the posted configuration on the indexers, I just kinda assumed you didn’t want to due to the nature of your question. The configs should be helpful either way, the key is the events need to be sent from a Universal Forwarder to two different Splunk instanes, which is where the index change occurs. ... View more

I’m not saying this is the only way, but it’s the only way I could think of. Maybe another option would be to have a [default] props entry pointing to a transform to change the index on the indexers. If you go this route, maybe you do this on the old indexers and change your inputs on the forwarders to point to the new index. This way you leave your complexity on the indexers that will be retired. ... View more

You’re going to have issues monitoring the same file twice. Splunk will realize it’s already been indexed and skip it. ... View more

Can you include what Month looks like prior to your changing it with substr ? ... View more

So when you view the data in Splunk, does the extracted time agree with what your CSV has? ... View more

You need to specify your monitor stanza such that it will only index completed csv files: [monitor://<path>/*.csv] instead of [monitor://<path>/*] ... View more

My question would be, "what do you want to do with the JSON structures after you've run transaction ? Could you accomplish what you need without transaction (often possible, but not always)? And perhaps do you really need the JSON structures of individual events at the end of all of that? ... View more

You need a trailing slash (or more specifically, a slash to denote the end of your replacement string and the start of flags): SEDCMD-test = y/o/O/ From the props.conf SEDCMD section: substitute - y/string1/string2/ ... View more

So, your sample data already has mixed timezones? Or is that sample data representative of how Splunk parsed it? If the latter, can you include the actual CSV prior to having Splunk handle it? ... View more

Nice solution! You may consider accepting your answer so the question no longer appears open, and others have an easier time finding the solution. ... View more

Once an event is in the parsing queue, changing its sourcetype will not result in the new sourcetype's props/transforms being run on it. There is a way to do what you're looking for with CLONE_SOURCETYPE . Basically you would clone the hello world event into the sourcetype myxactdata , then drop the event of the original sourcetype. The new sourcetype would have its props/transforms run, so you could change index and use SEDCMD for that sourcetype. Or, you could use the same REGEX you used to determine you wanted to change the sourcetype to not only change the sourcetype, but also the index, and also run a TRANSFORM on it at index time to accomplish what your SEDCMD did ( DEST_KEY = _raw to rewrite _raw). Edit: Perhaps your question didn't indicate you were trying to change the sourcetype and use the new sourcetype's props/transforms to perform the extra steps. You can definitely perform multiple index time operations on an event, but make sure the order of operations isn't getting in the way. For instance, if you use SEDCMD, does your REGEX to set the sourcetype/index no longer match? ... View more

Trellis appears to have been introduced in Splunk 6.6. http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/VisualizationTrellis ... View more

This was the idea I had, as the entire use case at my company was for SIEM purposes, and if you weren't included in the CIM, your data didn't do anything. I left the company before implementing this, but my initial thought was to allow for generic datamodel adherence in a format like: <timestamp> <tag1> <tag2> ... <tagN> <key1>=<value1> <tab> <key2>=<value2> ... <tab> <keyN> = <valueN> This allows anyone to send a log that could conform to the CIM by including the tags that the CIM needs, and the key/value pairs that the CIM wants. With something like that, a single sourcetype can handle all the parsing and feed any CIM datamodel necessary. ... View more

If your results are in a CSV, and you're using a scheduled search to get the results into the CSV, you don't need to monitor the CSV at all. You can just use | inputlookup <csv> every time you run a search instead. ... View more

Considering the "enterprise wide" aspect, I think it makes sense for the team running Splunk to specify a format for your logs to come over, considering you are the ones generating the logs. Why make the Splunk team create props/transforms for each different app's data when it's easier to ask the developers to adhere to a standard they already have configurations for? ... View more

OK, I'm not happy with this answer, but after much testing it's all I have. The _audit data comes isn't from a "normal" input, it seems. Try to find an inputs.conf stanza that points data to _audit , or a transform that shuffles data into _audit . As best I can tell, they don't exist. I imagine this is because the audittrail data comes from within splunkd and is never logged to a file, and doesn't use anything like a scripted or modular input to push it to splunk. Hence it bypasses props/transforms entirely. The only workaround I could come up with is to take the opposite approach: forward everything by default via outputs.conf, and use a [default] stanza in props.conf to skip forwarding for everything that matches (which won't happen for audittrail). This method prevents you from further filtering on "login attempt", but I can't find a way to selectively match audittrail events (as per the above paragraph's conclusion). Here is the config that will forward only audittrail, leaving everything else to only index locally: outputs.conf [indexAndForward] index = true [syslog] defaultGroup = syslog_server [syslog:syslog_server] server = x.x.x.x:514 props.conf [default] # _audit seems to not match [default] so we do this in reverse and send everything that matches to "nowhere" TRANSFORMS-routing = dont_forward_anything transforms.conf [dont_forward_anything] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = nothing ... View more

How is your search taking data from the CSV files? Are they indexed files, or are you using | inputlookup or something else? ... View more

| stats count BY CS_USERNAME ... View more

I don't think @elliotproebstel will mind that I took the liberty of converting the comment to an answer for him. ... View more

Which username are you intending to get substituted? ... View more