So as an update: Graciously Nimish had a conversation with me offline, and pointed me in the right direction! In short, I'm doing redis lookups from a search head against a number of indexers. When the search gets ditributed the indexers run the search and need to reach the redis DB. I suspect you could run multiple redis databases, or do what I did, which is open the redis server on the search head to the indexers. So when I built my redis connection in the script, rather then hitting localhost I do something like this red = redis.Redis(host='splunksearch.example.com', port=6379, db=0) In addition I found that I could use the EPEL version of python-redis with by doing this in my script sys.path.append("/usr/lib/python2.4/site-packages/") Unfortunately, I've got RHEL5 and RHEL6 indexers and search heads in my cluster which have slightly different path's to python, /usr/lib/python2.4 VS /us/lib/python2.6 so i'm creating a symlink on all my Splunk servers to /usr/lib/python So far this seems like it's working pretty ok! Some of this may be totally self evident, but I'm pretty new to python/redis . In any case I hope this helps someone else out who wants redis running with distributed search! ... View more

I'd recommend pulling this into a totally new question. You will probably want to get details on the SATA drives you're using - Model, RPM, etc - as well as how many of them you're using in your aggregate. 400 IOPS may be "good" for the configuration you have... ... View more

link above has moved to : http://docs.splunk.com/Documentation/Splunk/latest/Data/Assignmetadatatoeventsdynamically ... View more

Another option is to write your own search command. I'm not familiar with YAML, but I goggled it and quickly found a python parser PyYAML for it. I would suggest that you take a look at the search commands xmlkv and xpath that work with XML, and see if you could borrow the basic idea of those search commands and then write something similar for YAML using the PyYAML library. You can find many example search commands in the "search" app: $SPLUNK_HOME/etc/apps/search/bin/ Specifically I think that xpath.py is a good example of a search command that loads a python module and then uses that module to extract some field based on the structured data stored within the splunk event, and then adds a new field back into your splunk event, which can be then used by subsequent search commands. Pretty simple, huh? Seriously it's not very difficult to do, especially if you have any programming experience at all. I've written a few search commands myself with very minimal effort. Besides the documentation, you may also find reviewing topics with the custom-search-script tag on this site to be helpful too. ... View more

Hey thats awesome! Have you had any luck writing to tags.conf? I copied a lens and got it working, but wasn't ever able to get it to correctly write to tags.conf, something about the equal symbol in the section header. I'll check out your lens too! Thanks for posting this! ... View more

If you always want the users to query from the same fixed time zone, while the data comes in (correctly interpreted and converted by Splunk to the "real" UTC time), you could consider setting up a dedicated search head for that time zone. Make sure the Splunk process runs in that time zone, and all displayed and queried times will by default be displayed and queried using the time zone of the search head. ... View more

Jrodmap, The problem is not so easy and doc doesn't help. I've been doing the same here with a prospect customer. Transaction can't fully help becuse the several events to correlate never have ALL the same fields needed to "transaction" command. The transaction flows from one log to the other, and the startling identifying field (queue_id) then must be linked to the "from" field and a "message_id" in the amavis logs. So, how is it possible to link events correlated from a chain of different fields? Regards, marco ... View more

This is an older thread but wanted to provide an updated answer to the question since it appears high on Google search results. There is a specific module to manage configuration of Splunk with Puppet. You can find out more information here: https://forge.puppet.com/puppet/splunk. ... View more