Hello, I have a hardware architecture for my Splunk INDEX as follows: 8 CORES Xeon 2.4GHZ and 40GB RAM And for my SEARCH HEAD 8 CORES Xeon 2.4GHz and 8GB RAM I'm upgrading to 55GB daily, and I wonder if this will be ideal architecture below: SPARC T5 16 CORES 3.6GHz 48GB RAM ... View more

I am using the following search to extract the time usage of the internet by user report: index = "cisco_wsa" SourceType = "cisco_wsa_squid" | transaction user maxpause = 5m | stats sum (duration) the Duration by CN | sort -Duration | Lookup light_atributos_principais CN OUTPUT User, Company, CostCenter, DepartmentNumber, OR | Duration fieldformat tostring = (duration, "duration") | eval Superintendencia = substr (DepartmentNumber, 0, 2) | search DepartmentNumber = "LTO" | head 10 | sort -Duration | CN rename the Matricula, the Company Company CostCenter the "Cost Center" DepartmentNumber the Department, the OR Management | User table, Matricula, Company, Department, Management, "Cost Center" Superintendencia, Duration The report is created without problems, but I cannot speed the same, and he acabanão generating the data altogether. what I should do to improve the performance of the report? ... View more

Hello I am using the Add-on for Check Point OPSEC LEA Linux, but I'm having problems searchin on the indexed logs in Splunk. The data is indexed, the license and indexing report is showing activity, but when searching this data, I cannot get results. I'm seeing the following errors in Splunk: 10-30-2014 14: 57: 19,532 ERROR -0200 ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity SplunkLEA" / bin / sh: / opt / splunk /etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh: No such file or directory 10-30-2014 14: 57: 19,532 ERROR -0200 ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity SplunkLEA" / bin / sh: / opt / splunk /etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh: No such file or directory 10-31-2014 09: 20: 49,216 ERROR -0200 ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity SplunkLEA" sh:! [CDATA [1386266990 @ SplunkLEA : No such file or directory The variable $ SPLUNK_HOME is working properly. ... View more