What if you have multiple that you want to rename the same? | rename "Message.TaskInfo.CarHop Backup.LastResult"="-2147020576" AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=1 AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=0 AS Result | rename "Message.TaskInfo.AI Restart Weekly.LastResult"=267011 AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=267009 AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=2 AS Result This is not working for me   ... View more

I can't explain why it was decided to have this field alias, but it's within the [opsec:ips] stanza [opsec:ips] ... FIELDALIAS-dvc_for_opsec = orig as dvc, orig as dvc_ip FIELDALIAS-signature_for_ips = Protection_Name as signature FIELDALIAS-src_for_opsec = orig as src, orig as src_ip I'm not sure if the source formatting has changed or ?? ... View more

There is a similar question https://answers.splunk.com/answers/308062/splunk-db-connect-2-windowserror-error-32-the-proc.html#answer-320024. I don't know about the winsock warning, but I suspect the ERRORs are to do with Splunk being able to rollover the py_health.log file ready for the next generation of the file. Dave ... View more

Hi mate According to Splunk, the best practice would be to play with permissions of the knowledge objects and setting up user roles. http://docs.splunk.com/Documentation/Splunk/6.3.3/Security/SecuringaccessforSplunkknowledgeobjects ... View more

Are you referring to the message about the Splunkweb interface or the Streaming XML ? ... View more

When you purchase the license it is received in email and generally attached to your splunk.com account. You have to "upload" the license to the server. So yes, you would create a backup of the license prior to uploading it to the server. The license is found here in case you lost the email: $splunk_home/etc/licenses/ ... View more

I have an alert manager ( the app) that is executing a script, whenever an alerts is being triggered. At that stage it produce some data, using the rest API that are saved on the kv stores ... View more

Look at this link: http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Forward_data_for_a_single_index_only Outputs.conf: in “$splunkhome$/etc/system/local/outputs.conf Something like what is below: [tcpout] defaultGroup = local indexAndForward=true forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = alerts [tcpout:whatever] -- Whatever it is set to now should work if it is already forwarding everything. ... View more

I'm trying using this way, I did exactly as you wrote here so cn1 as response_code, but when I add the new logs in splunk the field name is not changing... I'm using a cluster, I placed the file under master-app/_cluster/local and next I did the bundle, could this be the reason of the problem? ... View more

It's easy to pass on html dashboard and use global variable that will contain all your data var array=[] var obj ={} obj.array=array; var content = { "field1":value1, "field2":value2..... } then on submit action, you can retrieve (obj) and here you can insert in csv or kv store ... View more

Yes, it works perfectly, thank you! ... View more

Captain_election_process_has_deployment_implications Based on the above link, A cluster must consist of a minimum of three members. Is there any workaround to this ? ... View more

im façing the same issue couldn't see the indexes.conf file that I have pushed from master node, and I have tried ingesting data to that index, I got an error message, received the file on indexer-2 to index=test which is deleted/disabled. How to resolve this issue please ? ... View more

I tried to remove all the fishbucket and clean the indexer from 4 index. after restarting the forwarder, 2 of the index, where correctly reindexed, the other 2 not. I completely cleaned everything from the fishbucket folder on my forwarder, why is it not indexing old data? ... View more

yeah, basically the app isn't being done to run on ubuntu, if you look at the prerequisites you will see it. But I discovered it too late : ) ... View more

Thank you : ) ... View more

Yes, sorry, this is the script: #!/bin/sh INSTALL_FILE="splunkforwarder-6.2.3-264376-Linux-x86_64.tgz" #The script doesn't require the creation of a public pair ssh key # After installation, the forwarder will become a deployment client the passed argument $1 # Specify the host and management (not web) port of the deployment server # that will be managing these forwarder instances. DEPLOY_SERVER="$1" #outputs.conf OUTPUTS='[tcpout]\n defaultGroup= default-autolb-group\n\n [tcpout:default-autolb-group]\n\n server = $DEPLOY_SERVER:9997\n\n [tcpout-server://$DEPLOY_SERVER:9997]' #Input to monitor needs to be changed INPUTS='[monitor:///var/log/*]\n sourcetype=syslog\n host_segment=3\n index=test\n\n [monitor:///var/log/messages]\n sourcetype=syslog\n host_segment=3\n index=test\n\n [monitor:///var/log/lastlog]\n sourcetype=syslog\n host_segment=3\n index=test\n\n' echo 'checking network...' if wget -q 'http://www.splunk.com/bin/splunk/DownloadActivityServlet? architecture=x86_64&platform=Linux&version=6.2.3&product=universalforwarder&filename=spl unkforwarder-6.2.3-264376-Linux-x86_64.tgz&wget=true' > /dev/null; then wget -O splunkforwarder-6.2.3-264376-Linux-x86_64.tgz 'http://www.splunk.com/bin/splunk/DownloadActivityServlet? architecture=x86_64&platform=Linux&version=6.2.3&product=universalforwarder&filename=spl unkforwarder-6.2.3-264376-Linux-x86_64.tgz&wget=true'> /dev/null; tar xvzf splunkforwarder-6.2.3-264376-Linux-x86_64.tgz -C /opt useradd splunk chown -R splunk /opt chown -hR splunk /var /opt/splunkforwarder/bin/splunk enable boot-start -user splunk --no-prompt --accept-license -- answer-yes sudo -u splunk /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto- ports --no-prompt --accept-license --answer-yes /opt/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOY_SERVER:8089\" --accept-license -- answer-yes --auto-ports --no-prompt -auth admin:changeme cd /opt/splunkforwarder/etc/system/local/ touch inputs.conf cd /opt/splunkforwarder/etc/system/local/ touch outputs.conf echo -e $OUTPUTS > outputs.conf echo -e $INPUTS > inputs.conf /opt/splunkforwarder/bin/splunk restart else echo 'Seems that your machine is not connected with internet, before to procede be sure that the installation file is on your machine'; fi echo "---------------------------" echo "Done" ... View more

Thank you! 🙂 ... View more

Coming back to this question: due to network constraints, I'd like to have my heavy forwarder instance sending to my indexer instance only the data related to an alert triggering - is it possible to do this? Thanks!! ... View more

Then you will end up with Splunk Enterprice Security... but that will cost you... see: https://splunkbase.splunk.com/app/263/ http://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/splunk-app-for-enterprise-security.html edit: Typo ... View more

whitelist=security.log$|access.log$, do you think I can monitor these using regular expressions? ... View more

I'm currently checking using netstat -at and I m listening at the port 9997. As local address I have my indexer:9997 and my indexer:8089, as foreign address I have the ip of the forwarder, but this only for one of the 4 forwarders, could this means anything ? ... View more