Are you trying to display the timestamp from UTC to EST in the Splunk Web interface when a user performs a search? If so, you can adjust the timezone setting for a user's search results by adjusting their user settings. https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Applytimezoneoffsetstotimestamps#Set_the_time_zone_for_a_user.27s_search_results ... View more

I'm assuming when you are referring to the URL logs, you are referencing the AWS Elastic Load Balancer (ELB) Access Logs. If so, you can easily ingest the ELB Access Logs into Splunk Enterprise through the Splunk App for AWS via the S3 input. Here is the configuration guide for the S3 input for the Splunk Add-on for AWS and the Splunk App for AWS. Splunk Add-on for AWS - S3 Input Configuration http://docs.splunk.com/Documentation/AddOns/released/AWS/S3 Splunk App for AWS - S3 Input Configuration http://docs.splunk.com/Documentation/AWS/4.2.1/Installation/S3 ... View more

The latest version of the Splunk App for AWS includes a lot of new monthly billing reports that can be split by Account, Service, Region, etc. Here's a link to the documentation and details for the AWS Billing Dashboards. ... View more

From the CLI, you would navigate to the $SPLUNK_HOME/bin/ directory and then you can an issue a splunk command to monitor a directory and/or file(s) with the forwarder. Here is an example of the splunk command to monitor the /var/log/ directory: ./splunk add monitor /var/log/ This splunk command will add a monitor stanza to the inputs.conf file. Here are additional details on how to leverage the CLI to add more input monitors. http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs#Use_the_CLI I'm not familiar with the FreeNAS app, but in general you can install apps/add-ons through the web interface for Splunk Enterprise. Here is the documentation on how to install apps/add-ons to a single Splunk Enterprise instance. http://docs.splunk.com/Documentation/AddOns/latest/Overview/Singleserverinstall ... View more

Also, here's a Splunk Storage Sizing tool to help you estimate the amount of storage needed for your use case. https://splunk-sizing.appspot.com/ ... View more

I'd try experimenting with the Splunk Add-on for Cisco ASA (https://splunkbase.splunk.com/app/1620/) since it appears that one of the metrics that maps to the Common Information Model (CIM) is 'Network Traffic'. http://docs.splunk.com/Documentation/AddOns/latest/CiscoASA/DataTypes I don't currently have a Cisco ASA to test with, but this add-on may help to provide enough information to run a search against the network traffic fields such as 'bytes', 'bytes_in', or 'bytes_out'. Here is more information on the 'Network Traffic' data model for the Common Information Model. http://docs.splunk.com/Documentation/CIM/4.3.1/User/NetworkTraffic ... View more

If you are running Splunk Enterprise 6.1 or later on your indexers/search heads, the easiest way to view the health of all your Splunk instances is with the Distributed Management Console (DMC). The DMC provides out-of-the-box dashboards for search activity, indexing performance, resource usage, etc. for all the Splunk instances. Here are additional details for the Search Activity dashboard within the DMC. http://docs.splunk.com/Documentation/Splunk/6.3.2/DMC/SearchactivityInstance Here are the setup steps for a multi-instance deployment of the DMC. http://docs.splunk.com/Documentation/Splunk/6.3.2/DMC/Deploymentsetupsteps ... View more

The ELB setup with a Splunk Search Head Cluster doesn't require any special changes on the Splunk side for access. You will want to verify the following setup steps on the ELB and Security Groups are correct: Configure all the proper Security Groups to allow the ELB to communicate with the Search Heads within your VPC. Here are the recommended Security Group rules for the ELB with back-end instances such as Splunk Search Heads (http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-groups.html#recommended-sg-rules) Configure the ELB listener to the proper web port for your back-end instance (aka Splunk Search Head). The default web port for a Splunk Search Head is 8000, but this port can be changed on Splunk if needed. Verify that the health check between the ELB and the Splunk Search Heads is working and that the Splunk Search Heads are 'InService'. One possible issue can be that the ELB health check is failing and taking your Splunk Search Heads out of service. If you are using an HTTP health check with a ping target of HTTP:8000/, this check on the Splunk Search Head will fail since the ELB Health Check is expecting a 200 response code and the Splunk Search Head will actually return a 303 redirect response instead. The Splunk Search Head URL is typically http://hostname:8000/en-US/account/login?return_to=%2Fen-US%2F so the health check ping target would need to be HTTP:8000/en-US/account/login?return_to=%2Fen-US%2F for it to work properly. One setting for the ELB and all other load balancers with regards to Search Head Clustering is that you need to enable "sticky" or "persistent" connections so that a user remains on a single search head during their session. Here are more details regarding this setting: http://docs.splunk.com/Documentation/Splunk/6.3.2/DistSearch/UseSHCwithloadbalancers ... View more

Here is the link to the latest version of the Splunk App for AWS (https://splunkbase.splunk.com/app/1274/#/overview) that has made many improvements in ease of use regarding setting up various AWS data inputs ex. CloudTrail, Config, VPC Flow Logs, CloudWatch, S3, etc. The latest installation guide for the Splunk App for AWS not only provides installation steps for the app, but also guidance on setting up the AWS services and IAM permissions for the Splunk App for AWS. Splunk App for AWS Installation Guide http://docs.splunk.com/Documentation/AWS/latest/Installation/Abouttheapp Configuration guidance on AWS Services for the Splunk App for AWS http://docs.splunk.com/Documentation/AWS/latest/Installation/ConfigureyourAWSservices Configuration guidance on AWS IAM permissions for the Splunk App for AWS http://docs.splunk.com/Documentation/AWS/latest/Installation/ConfigureyourAWSpermissions ... View more

If the object storage service you are referring to is AWS S3, then the Splunk App for AWS v4 (https://splunkbase.splunk.com/app/1274/) has an easy to use data input for S3 buckets. Here are the instructions on how to setup a S3 data input for the Splunk App for AWS. http://docs.splunk.com/Documentation/AWS/latest/Installation/S3 ... View more

Here are the latest instructions on how to deploy the Splunk App for AWS version 4.0 (https://splunkbase.splunk.com/app/1274/#/overview) in a distributed Splunk environment. http://docs.splunk.com/Documentation/AWS/4.0.0/Installation/Installon-prem#Install_on_a_distributed_deployment ... View more

The latest version of the Splunk App for AWS version 4.0 (https://splunkbase.splunk.com/app/1274/) has simplified the process of adding one or more AWS accounts. All configurations for additional AWS accounts and data sources (CloudTrail, Config, VPC Flow Logs, CloudWatch, etc.) are now done all within the Splunk App for AWS. Here are the instructions on how to configure additional AWS accounts for the Splunk App for AWS. https://docs.splunk.com/Documentation/AWS/4.0.0/Installation/Setuptheapp ... View more

Here is a .conf2015 talk that my colleagues and I did on deploying a highly available Splunk Enterprise architecture on AWS. We talk about how to leverage DNS entries instead of hardcoding IP addresses in your forwarders. Also, in Splunk 6.3 we introduced the new feature, indexer discovery, which allows the forwarders to get the full list of indexers from the master node. Indexer Discovery Overview and Setup http://docs.splunk.com/Documentation/Splunk/6.3.1/Indexer/indexerdiscovery Slidedeck from .conf2015 - Deploying Splunk on Amazon Web Services http://conf.splunk.com/session/2015/conf2015_SYep_Splunk_Cloud_DeployingSplunkOnAmazon.pdf Recording from .conf2015 - Deploying Splunk on Amazon Web Services http://conf.splunk.com/session/2015/recordings/2015-splunk-126.mp4 ... View more

Here is a .conf2015 talk that my colleagues and I did on deploying a highly available Splunk Enterprise architecture on AWS. We talk about how to leverage autoscaling with the master node since it is a stateless server as mentioned in the above answer. Slidedeck http://conf.splunk.com/session/2015/conf2015_SYep_Splunk_Cloud_DeployingSplunkOnAmazon.pdf Recording http://conf.splunk.com/session/2015/recordings/2015-splunk-126.mp4 ... View more

Splunk Enterprise provides the ability to create indexer clusters with index replication to achieve high availability and fault tolerance. Splunk Enterprise Index Cluster Overview http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Aboutclusters Splunk Enterprise Index Cluster Architecture http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Basicclusterarchitecture Splunk Enterprise Indexer Cluster Deployment Overview http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Clusterdeploymentoverview Also, here are system requirements/recommendations for both physical and virtual hardware to run Splunk Enterprise. http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/Systemrequirements#Splunk_Enterprise_and_virtual_machines Here is a Splunk tech brief that provides additional details on deploying Splunk Enterprise in a virtual environment. https://www.splunk.com/content/dam/splunk2/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf ... View more

Splunk doesn't have any limitations on any particular time ranges while running a search. Splunk provides an easy to use time range picker to choose either preset time ranges, custom time ranges, specific time ranges based on date or date and time, or advanced features within the time range picker. http://docs.splunk.com/Documentation/Splunk/6.3.2/Search/Selecttimerangestoapply I'd also check the date and timestamps of the data being sent to Splunk to verify that it's correct and not being sent with an incorrect date. ... View more

Yes, if you are using the Splunk Enterprise AMI located on the AWS marketplace (https://aws.amazon.com/marketplace/pp/B00PUXWXNE ), then SSH should be enabled by default. The Splunk Enterprise AMI is using Amazon Linux so the default user would be 'ec2-user' to connect via SSH. Here are additional details on how to connect to EC2 instances via SSH. http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html#AccessingInstancesLinuxSSHClient You may also want to check that you are using the correct private key pair while connecting via SSH to your EC2 instance. ... View more

The Splunk Universal Forwarder can be used to monitor the EC2 instance running Linux. Here are the instructions on how to install the Splunk Universal Forwarder on *nix systems that will include Linux instances running on EC2. http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Deployanixdfmanually ... View more

Event hashing been deprecated since Splunk 5.0, but the good news is that Splunk 6.3 has released the latest feature called Data Integrity which replaces Event Hashing. The new Data Integrity feature supports both distributed search and cluster configurations. Here is a blog post for more in depth information regarding the new Data Integrity feature: http://blogs.splunk.com/2015/10/28/data-integrity-is-back-baby/ Splunk Documentation on how to enable Data Integrity http://docs.splunk.com/Documentation/Splunk/6.3.0/Security/Dataintegritycontrol ... View more

Are you using t1.micro instances? If so, I'd recommended trying the newer t2.micro instances since it has better baseline performance, burstable performance, and they are cheaper. ... View more