Hey thats awesome! Have you had any luck writing to tags.conf? I copied a lens and got it working, but wasn't ever able to get it to correctly write to tags.conf, something about the equal symbol in the section header. I'll check out your lens too! Thanks for posting this! ... View more

So as an update: Graciously Nimish had a conversation with me offline, and pointed me in the right direction! In short, I'm doing redis lookups from a search head against a number of indexers. When the search gets ditributed the indexers run the search and need to reach the redis DB. I suspect you could run multiple redis databases, or do what I did, which is open the redis server on the search head to the indexers. So when I built my redis connection in the script, rather then hitting localhost I do something like this red = redis.Redis(host='splunksearch.example.com', port=6379, db=0) In addition I found that I could use the EPEL version of python-redis with by doing this in my script sys.path.append("/usr/lib/python2.4/site-packages/") Unfortunately, I've got RHEL5 and RHEL6 indexers and search heads in my cluster which have slightly different path's to python, /usr/lib/python2.4 VS /us/lib/python2.6 so i'm creating a symlink on all my Splunk servers to /usr/lib/python So far this seems like it's working pretty ok! Some of this may be totally self evident, but I'm pretty new to python/redis . In any case I hope this helps someone else out who wants redis running with distributed search! ... View more

We've been running with out colddb's on iSCSI for a while now and it's been just fine. I think kddenton is right on, it's all about the IOPS. ... View more

I actually think this would be useful as well, something like kerberos's kadmin.local binary. ... View more

Ala Jim 🙂 Here's the XML we're working on... and as you stated, it will not work as is. Should I add a drop down that contains "*" or "NOT" in between the field=$something$? That might get pretty busy, since I already have a lot of fields. <searchTemplate>sourcetype=smartsAlerts service_class=$service_class$ group_owner=$group_owner$ element_name=$element_name$ element_class=$element_class$ event=$event$ | transaction name=active_alerts | search active=$active$</searchTemplate> <fieldset autoRun="true"> <!-- the default is a text box, with no seed value; if user does not input a value, then the $from$ token in searchTemplate will be removed --> <input type="text" token="service_class"> <label>service class</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="group_owner"> <label>group owner</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="element_class"> <label>element class</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="element_name"> <label>element name</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="event"> <label>event</label> <default>*</default> <seed>*</seed> </input> <input type="dropdown" token="active"> <populatingSavedSearch fieldForValue="active" fieldForLabel="active"><![CDATA[drop down active]]></populatingSavedSearch> <label>active?</label> <choice value="true OR false">Both</choice> <default>true</default> <seed>true</seed> </input> <input type="time" /> </fieldset> ... View more

Here is my current (working) manifest! (v.2) class splunk::forwarder { $mod = "splunk" service { "splunk": ensure => running, enable => true, hasrestart => true, hasstatus => false, pattern => "splunkd", subscribe => [ Package["splunk"], File["/opt/splunk/etc/apps/unix"], File["/opt/splunk/etc/apps/SplunkLightForwarder"], File["/etc/init.d/splunk"] ] } package { "splunk": ensure => installed, } file { "/opt/splunk/etc/splunk.license": mode => "644", owner => "splunk", group => "splunk", backup => true, ensure => present, require => Package["splunk"], source => "puppet:///modules/$mod/noarch/opt/splunk/etc/splunk-forwarder.license"; "/etc/init.d/splunk": mode => "700", owner => "root", group => "root", ensure => present, require => Package["splunk"], source => "puppet:///modules/$mod/noarch/etc/init.d/splunk"; "/opt/splunk/etc/passwd": mode => "600", owner => "root", group => "root", backup => true, ensure => present, require => Package["splunk"], source => "puppet:///modules/$mod/noarch/opt/splunk/etc/passwd"; "/opt/splunk/etc/auth": owner => "splunk", group => "splunk", mode => "600", recurse => true, purge => false, require => Package["splunk"], source => "puppet:///modules/$mod/noarch/opt/splunk/etc/auth"; "/opt/splunk/etc/apps/unix": owner => "splunk", group => "splunk", recurse => true, purge => false, require => Package["splunk"], source => "puppet:///modules/$mod/noarch/opt/splunk/etc/apps/unix"; "/opt/splunk/etc/apps/SplunkLightForwarder": owner => "splunk", group => "splunk", recurse => true, purge => false, require => Package["splunk"], source => "puppet:///modules/$mod/noarch/opt/splunk/etc/apps/SplunkLightForwarder", } } ... View more

Awesome! I think that will work well! I'll post my current manifest! Thanks much guys! ... View more

I'm using just the init script (/etc/init.d/splunk start|stop|restart) to start the forwarder, I suppose I could edit the script after it's created, but I was hoping there was a better way to accept, or place the license. I'm trying create an automated deploy with puppet, for our standard builds. ... View more

This is a great question! I'm writing a puppet manifest to deploy my forwarders based on this answer. However I can't seem to get the forwarder license right. I'm copying "splunk-forwarder.license" into splunk.license" but I still get a EULA on first start... is there something i'm missing? I'd be happy to post my manifest here as an example once I'm finished! Thanks! ... View more

Well, I think I have the reverse problem.. I have the correct time zones in the logs (EST) but I want users to query them based on a variable time zone. I'm looking to pass a time zone into my search, and have the logs searched offset correctly. ... View more