Is it possible to have the latest version of index server that will work with 4.2.4 search head? We are planning upgrade everything, but meanwhile I have to install another index server before the upgrade... ... View more

I have 2 index servers that is LB and listening to port 9997. Both are getting a lot of this message in splunkd.log: 06-19-2012 10:23:59.920 ERROR TcpInputProc - Error encountered for connection from src= : . Timeout Is it because the port 9997 is saturated? Do I need more index server to fix the issue? How do I debug it? Or, how can I determine if NIC TCP 9997 is saturated without installing 3rd party tool? ... View more

I'm adding another index server into a cluster of distributed search indexes. What is the easiest way to export the custom indexes in the existing index servers to the new server beside manually adding each index by hand and copy the indexes.conf to the new one? ... View more

In my app opt/splunk/etc/apps/cust_unix/local/inputs.conf I have these lines below, and I'm assume it will run every 5 sec. Seems like it'll run whenever it feel like, and no time pattern. How to debug this? inputs.conf: [script://./bin/cpu.sh] sourcetype = cpu source = cpu interval = 5 index = os disabled = 0 cpu.sh: . dirname $0 /common.sh HEADER='CPU pctUser pctNice pctSystem pctIowait pctIdle' HEADERIZE="BEGIN {print \"$HEADER\"}" PRINTF='{printf "%-3s %9s %9s %9s %9s %9s\n", cpu, pctUser, pctNice, pctSystem, pctIowait, pctIdle}' if [ "x$KERNEL" = "xLinux" ] ; then queryHaveCommand sar FOUND_SAR=$? queryHaveCommand mpstat FOUND_MPSTAT=$? if [ $FOUND_SAR -eq 0 ] ; then CMD='sar -P ALL 1 1' FORMAT='{cpu=$(NF-6); pctUser=$(NF-5); pctNice=$(NF-4); pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$NF}' elif [ $FOUND_MPSTAT -eq 0 ] ; then CMD='mpstat -P ALL 1 1' FORMAT='{cpu=$(NF-9); pctUser=$(NF-8); pctNice=$(NF-7); pctSystem=$(NF-6); pctIowait=$(NF-5); pctIdle=$(NF-1)}' else failLackMultipleCommands sar mpstat fi FILTER='/Average|Linux|^$|%/ {next} (NR==1) {next}' elif [ "x$KERNEL" = "xSunOS" ] ; then if [ $SOLARIS_8 -o $SOLARIS_9 ] ; then CMD='mpstat -p 1 2' else CMD='mpstat -q -p 1 2' fi assertHaveCommand $CMD FILTER='(NR<=2) {next} ($1 >= "0") {inBlock=1} (!inBlock) {next}' FORMAT='{cpu=$1; pctUser=$(NF-4); pctNice="?"; pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$(NF-1)}' elif [ "x$KERNEL" = "xDarwin" ] ; then CMD='sar -u 1' assertHaveCommand $CMD FILTER='($0 !~ "Average") {next}' FORMAT='{cpu="all"; pctUser=$2; pctNice=$3; pctSystem=$4; pctIdle=$5; pctIowait="?"}' elif [ "x$KERNEL" = "xFreeBSD" ] ; then CMD='iostat -C -c 2' assertHaveCommand $CMD FILTER='(NR<4) {next}' FORMAT='{cpu="all"; pctUser=$(NF-4); pctNice=$(NF-3); pctSystem=$(NF-2); pctIdle=$NF; pctIowait="?"}' fi $CMD | tee $TEE_DEST | $AWK "$HEADERIZE $FILTER $FORMAT $PRINTF" header="$HEADER" echo "Cmd = [$CMD]; | $AWK '$HEADERIZE $FILTER $FORMAT $PRINTF' header=\"$HEADER\"" >> $TEE_DEST ... View more

I'm looking for the regex for extracted fields in a custom built app. I cannot find them in any props.conf and transforms.conf. Are they stored in different location for Apps? ... View more

I'm having problem extracting field below. I'm trying to extract "count_r5= " but the Interactive Field Exaction is grabing everything in field #7 which has other data I don't want: (?i)^(?:[^ ]* ){7}(?P [^ ]+) 05/Jun/2012:15:36:00 count_total=2162 count_r1=759 count_r2=755 count_r3=280 count_r4=218 count_r5=150 count_active=448 I can do it in the search line: rex field=_raw \"count_r5=(? .+)\". How would I go about saving it? ... View more

I know data was there becasue I've created a report 2 weeks ago. Now same search for same time frame is getting a zero return. How can I debug this issue? ... View more

Hi, I have this error message repeats twice every 5 seconds in splunkd.log: "ERROR AuthenticationManagerLDAP - Could not find user: abc" Where can I track down this misconfiguration? thanks! ... View more

Hi, Is there any advantage to setup up Universal Forwarder to communicate different ports with index servers with load balancing instead all go to port 9997? [tcpout] autoLB = true autoLBFrequency = 10 compressed = false defaultGroup = AA [tcpout:AA] server = a1-abc.com:9995,b1.abc.com:9996,c1.abc.com:9997 ... View more

If I've this in the outputs.conf in the fowarder: [tcpout] autoLB = true autoLBFrequency = 10 compressed = false defaultGroup = BBB [tcpout:AAA] server = aaa.abc.com:9997 [tcpout:BBB] server = bbb.abc.com:9997,bbb2.abc.com:9997 [tcpout:CCC] server = ccc.abc.com:9997 [tcpout-server://:9997] Would I be sending same data 3 times which BBB get load balancing? Does that mean I'm burning 2 extra licenses? ... View more