DBX3 currently does not support using variables within a DB input statement. You can use parameters for things such as rising columns. http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseinputs Basically, you would likely need to create a view if it is possible for the query you are attempting. ... View more

Based on the error that you provided it sounds like the account that you are using to start the splunkd forwarder process most likely does not have the necessary level of permissions to start Splunk as a service. I would suggest checking windows services.msc and either update the account by re-entering the password(if it is incorrect), use an account with a higher permission level, or use a local system account(which is the default if you didn't specify an account when installing). ... View more

If you want to push outputs.conf itself see below: you can use this link to be aware of .conf file precedence to accomplish this: http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles Create an app with an outputs.conf and push it out to the forwarder. The deployment server should find that the app has been created and automatically push it as long as the server has been added as a client machine to the server class itself. Note that the system/local directory takes priority so you must ensure that the properties in system/local are not already utilized otherwise, it won't take precedence. ... View more

Can you provide more clarity on this? Forwarder management is just one methodology for managing forwarders. Adding apps to the server class is the "out of the box" method provided by splunk to add apps to remote universal forwarders. Do you want to push the outputs.conf file itself to the forwarder? If so, you can use this link to accomplish this: http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles Create an app with an outputs.conf and push it out to the forwarder. Note that the system/local directory takes priority so you must ensure that the properties in system/local are not already utilized otherwise, it won't take precedence. ... View more

Based on the search above you should probably utilize the stats command. Also, you may need to create a field for this. Something such as Doctype. Once you have the field extraction in place you can run the stats command |stats count by Doctype Note that the field name will be case-sensitive. Below is the field extraction documentation: http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/ExtractfieldsinteractivelywithIFX ... View more