14 years later, I'm coming here to say THANK YOU! One of my backburner projects has been trying to figure out why we've been getting "cron-2" and "error.log-too_small" type sourcetypes for over a year now. Simply defining the sourcetype for each file, as you suggested, has fixed the issue.  You, @hulahoop, are a lifesaver. ... View more

@Chris_R_ FYSA all 3 of your urls no longer work. ... View more

What error are you seeing? The closing </form> tag in your example actually comes all the way at the end of the simplified XML. In HTML you'd close your form after your last fieldset but in simplified XML you dont close the form tag until after all the <row> elements that contain charts and tables etc.. ... View more

Lowell, thanks i am getting better results with: curl -k -u admin:changeme -d "search=search * &preview=1&status_buckets=300" https://server:port/services/search/jobs The job seems to stay alive much longer ... View more

GK: These are full forwarders, here's the outputs from a forwarder [tcpout] indexAndForward = false [tcpout:stonegateGroup] disabled = false server=10.20.12.35:9001 [tcpout:fortimailGroup] disabled = false server=10.20.12.33:9997 and the inputs.conf from a indexer [default] index = default host = fortimailsplunk _rcvbuf = 196608 [monitor://$SPLUNK_HOME/var/spool/splunk] move_policy = sinkhole [fschange:$SPLUNK_HOME/etc] signedaudit = true sendEventMaxSize = -1 recurse = true pollPeriod = 600 filesPerDelay = 10 delayInMills = 100 followLinks = false fullEvent = false hashMaxSize = -1 [splunktcp] route = has_key:_utf8:indexQueue;has_key:_linebreaker:indexQueue;absent_key:_utf8:parsingQueue;absent_key:_linebreaker:parsingQueue; Note: I had them remove the tcp route = stanza seems to not be blocking this morning, could be a slower day...but i'll know for sure next week ... View more

The crcSalt was set because the websphere logs all have a really big header which is identical in all the rotated logs, and splunk wouldnt index in the next SystemOut.log when it rotated. Ill check on the duplicate events w/_indextime value, Thanks ... View more

Question: I have one thought, that, how do we come accross setting the values for max_fd= ? What are the rationals setting values or it's random, what feels good for us? Some people say, increase or double in sequential way, using default value, till it resolves. ... View more

Hey Gerald, i know this is a really old question but did you mean target indexed value of 3 - 6 "kbps" or target "mbps" ? ... View more

What is the recommended solution on 4.3.2? Wildcards don't seem to work anymore. ... View more

Does this still hold true for version 5.0.3? i'm trying to implement this and can't seem to make it point to the new script. \Splunk\etc\apps\search\local\commands.conf [sendemail] filename = $SPLUNK_HOME/etc/apps/search/bin/my_sendemail.py streaming = false run_in_preview = false ... View more

Ok great, yeah setting the sourcetype in inputs.conf is usually the way to go. ... View more

Very clear, you help me cure my headache 🙂 Thanks a lot ! ... View more

tried this on splunk4.2.2, and got the following error in CLI ppang-mbp-2:bin paulpang$ ./splunk search "| debug cmd=roll index=main" FATAL: Error in 'DebugCommand': command=roll issued successfully to index=main, but debug command is deprecated, try the CLI command instead ... View more

Yes works, minor change to caCertPath, it's now serverCert ... View more

There appears to be a bug in 4.1.6 that ctime will NOT work. This seems to be resolved in 4.2.2. ... View more

What is the "date_zone" value for your indexed events? If your setting is in effect, it should be "0000" or "UTC" or "GMT" but DEFINITELY NOT "local". My suspicion is that you will find it is "local", which tells you that your TZ setting is not in effect. Here are a few reasons this might be so: 1: If you are doing any kind of host-override (including "host_segment"), props.conf will trigger off the ORIGINAL host value, not the new host value; you might be able to use [source::] instead of [host::] 2: You might not be deploying the props.conf file to your indexers which is where this configuration file needs to be in order to function (NOTE: there is a twist to this as of v6.0 in that a props.conf TZ setting on the forwarder will be honored and have precedence over the same setting on the indexer) ... View more

There is a new search-time option for this scenario. In splunk 4.1.5 the tonumber() eval command was added. This function allows conversions between different bases which can convert from hexadecimal (base-16) to a standard (base 10) value. | eval dec_value = tonumber(hex_value, 16) Of course you'd have to do this many times depending on how many fields you have. ... View more

It is true, typically. It's possible to set up a NAS to perform sufficiently, but the technical bar is higher. Note there's a wide variety of "NAS" hardware out there, from enterprise class down to 2 disks in a tinkertoy box. ... View more

This disables the app? Or does it remove the custom app folder from the deployment clients as well? ... View more

/splunk/bin/splunk _internal call /data/indexes/main/roll-hot-buckets /splunk/bin/splunk _internal call /data/indexes/access/roll-hot-buckets ... View more