The indexing metrics per host should come pretty close, they're built into the Splunk on Splunk app (pre-6.2) or the Distributed Management Console (6.2). They're both looking into index=_internal source="*metrics.log" sourcetype=splunkd , anything more specific than the prebuilt searches can be found in there. ... View more

Since "Last business day" depends on which month you are in, and what year you are in, you will have to explicitly set it up. There is not a builtin "Last business day" cron option. ... View more

There is a Splunk SOS app (http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk) which provide so many statistical data about splunk instance, and I believe Network volume is one the metrics it reports on. Worth checking out. ... View more

Try following: |metadata type=sources index=* | eval age=now()-recentTime | where age>420 This lists all the sources (files indexed in Splunk) which were last accessed 420 sec (7 min) ago. You can setup alert when this search returns rows. ... View more

Schedule the following search to run once a day, and send you an email with the results. index=main sourcetype="*security*" EventCode=4624 Logon_Type=3 |eval Account_Name=mvindex(Account_Name,1)|search NOT Account_Name="*$" NOT Account_Name="ANONYMOUS LOGON"| dedup Account_Name,ComputerName |table _time,Account_Name,ComputerName eval Account_Name=mvindex(Account_Name,1) Takes the second Account Name field from the event Message field. Check your logs to verify it is the second Account Name you're interested in, change the 1 to a 0 if you want the first. If you want to show both, let me know. search NOT Account_Name="*$" NOT Account_Name="ANONYMOUS LOGON" removes the system accounts and the NT Authority activity. Remove this if you want to show all accounts. dedup Account_Name,ComputerName Takes the most recent pair and drops the others. Remove this if you want to show each logon event. ... View more

the SEDCMD-remove_ffff is already present and commented in Splunk_TA_windows version 6.0 (but dont change in default file) so you could just : create/update Splunk_TA_Windows/local/props.conf [source::WinEventLog:Security] SEDCMD-remove_ffff = s/::ffff://g [source::WinEventLog:ForwardedEvents] SEDCMD-remove_ffff = s/::ffff://g [WMI:WinEventLog:Security] SEDCMD-remove_ffff = s/::ffff://g ... View more

You will need to put your command in a bat file. Save the file in a bin directory in the system or your app. $SPLUNK_HOME/etc/system/bin/ $SPLUNK_HOME/etc/apps/<APPNAME>/bin/ Then add it as a scripted input. The following page will give you more detail. http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs ... View more

Thank you. I will do that. ... View more

You do not need to install any cmdlets for for the TA-XA5-* addons. Look here for XenApp 6.0 -> http://community.citrix.com/display/xa/XenApp+6+PowerShell+SDK Look here for XenApp 6.5 -> http://community.citrix.com/display/xa/XenApp+6.5+PowerShell+SDK ... View more

Anything in here missing to answer your question? http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs Splunk does not do 'timed' monitoring. It can monitor your folder and pick up any *.msg file when it appears/changes. If you need to make sure that data is only indexed every 15 minutes (use-case?), setup a cronjob that copies the file "on the quarter hour" into the folder monitored by splunk and consider using a batch input, if your file size justifies it. ... View more

Server tokens Common tokens that provide details available from the Splunk platform server. Token Description $server.build$ Build number of the Splunk platform instance. $server.serverName$ Server name hosting the Splunk platform instance. $server.version$ Version number of the Splunk platform instance. ... View more

Another option would be to run one report inside of Splunk but trigger an external script that performs whatever alerting actions you need. That script could also check the time of day. ... View more

It might help to include your search, but I would guess that the search just needs to have the following added to the end of it: ... | fields - _raw ... View more

Thank you for the quick response. I have validated that I am getting data by having the windowsupdate.log being sent successfully from the same systems through the forwarder to the indexer. ... View more

I am not aware of a method by which you can limit a subcommand of the $SPLUNK_HOME/bin/splunk command from the root user, but keep in mind beyond that, that ever index is essentially written to database files in the $SPLUNK_HOME filesystem. Because of that the root user will always be able to delete those files. Such is the price of providing root access to users in a Unix/Linux environment. ... View more

I have set the variable as mentioned above and I still am not getting perfmon data. But I do get it from the TA-Windows add on. ... View more