You don't need a Splunk plugin for Log4net to get data from a .Net application into Splunk. One method is to use a FileAppender to write to a file, then monitor that file with a Splunk Forwarder. References: https://logging.apache.org/log4net/release/config-examples.html#fileappender http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Monitorfilesanddirectories ... View more

If you are already using a license master on an indexer, and switch your indexer to another master, you do not need to restart Splunk on the indexer. (Tested on Splunk 5.0.3) ... View more

Try https://vm-splunk:8089/services/search/jobs The REST API is provided by splunkd which is https by default. ... View more

For the question as asked, something like this might work for you: | inputlookup table1.csv | inputlookup append=t table2.csv | inputlookup append=t table3.csv | stats count by field1 However, you probably want to differentiate between the lookups, which you could do by having a second field ( lookup_name ) like so: | inputlookup table1.csv | inputlookup append=t table2.csv | inputlookup append=t table3.csv | stats count by field1 lookup_name Depending on your use case you may want to use a time-based lookup combining all of the results. ... View more

Can you post your curl request? This works for me: curl -k -u admin:changeme -d 'search="search * | head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export "_serial","_time",source,sourcetype,host,index,"splunk_server","_raw" 0,"2013-04-30 19:59:04.105 BST","/opt/apache/log/sl_access_combined.log","sl_access_combined","example.splunk.com","example","splunk.example.com","1.2.3.4 - - [30/Apr/2013 18:59:04:105] ""POST /url HTTP 1.1"" 503 878 ""http://example.com/referer"" ""Googlebot/2.1 ( http://www.googlebot.com/bot.html) "" 623" ... View more