Thanks Woodcock I'll investigate chart and timechart (it wasn't clear to me how to form a dashboard from my data). The monitor part is already working (I use the Splunk front end to set up an auto-monitor of my .txt file which is being updated by the temperature sensors every half hour). I note that Splunk datetime stamps each record anyway but I will include a datetime input on each row once I get a basic dashboard working. Regards Active. ... View more

Hi again I think I have answered my own question. Splunk appears to require installing under a domain account (requiring a Windows Server / Active Directory) before it's TCP Server will allow remote connections. A nice-to-have for the future would be the ability to receive data from remote devices without requiring a domain account. Regards Active. ... View more

Hi again, note that I am using the Splunk home page to set the parameters, I am not editing the conf files directly. There are 2 inputs.conf files 1 in etc\system\local (which has [default} and host = mypc) the other (later) in \etc\apps\search\local (which is empty). props.conf (2 copies, this is the latest in time) - [first_install-too_small] PREFIX_SOURCETYPE = True SHOULD_LINEMERGE = False is_valid = True maxDist = 9999 [export_metrics-too_small] PREFIX_SOURCETYPE = True SHOULD_LINEMERGE = False is_valid = True maxDist = 9999 transforms.conf is rather large and I cannot see any specific areas modified when I set up the Data Input. There does not appear to be a restart command that I can run from a command prompt. I believe the 'restriction' is more fundamental, is the Light version of Splunk limited to only listening for local clients (and refuses external clients), whereas the Enterprise version allows external clients? I deleted and re-established the Data Input and restarted the PC, the outcome was the same. Regards Active ... View more

Hi again To prove a point I changed my devices to be TCP Clients and also altered the string outputs to be fixed length, csv. I then ran a test TCP Server on the PC (port 7000) and I can see all my clients pushing data into this TCP server. I then shutdown the TCP server rebooted the PC and ran Splunk Light with a TCP input running on port 7000, source type set to structured csv, default index. I have a utility which shows Splunk supposedly running on port 7000 yet Start Searching shows no results found (o events) despite refreshing. I then ran Hyper Terminal on the same server as Splunk and search then showed data. However running Hyper Terminal on any external server (on the same subnet as the Splunk server) search then shows nothing. It seems that Splunk cannot accept data from any 'external devices'. I have not set a host restriction. Re-running a conventional TCP server accepts inputs from both the local and remote PC Hyper Terminal and remote devices. I may be doing something fundamentally wrong but I cannot see what. Thanks Active ... View more

Hi Woodcock I think I may have misunderstood what Splunk was capable of. Despite setting the source type and index (re my original post) there was still no output / sample data and I think this is because Splunk acts as a TCP server listening to the output of 'other' servers (rather than being able to launch TCP clients (similar to what Hyper Terminal does) which then listen to remote TCP servers, i.e. devices). That is why the 'suggested port' is 9997 which would generally be a single local server port and not multiple remote devices. Regards Active. ... View more