What version are your NIX and Windows apps? You will want to verify you are on the latest version. ... View more

What is the locale in the URL? Like mine is "en-US" here "http://searchhead:8000/en-US/app/launcher/home" ... View more

stand alone "all in one box" or what is your environment like? LDAP configured or splunk auth? did you try other browsers? other users having same issue? ... View more

what is your input stanza for this; and are you defining any props/transforms for this data? is this coming from a forwarder or straight into a single splunk server/indexer/search head ? ... View more

This topic is covered in the docs here: Set limits on disk usage ... View more

To clarify; disabling the indexing globally (all data), did you put indexAndForward=false under the [tcpout] stanza? so your outputs.conf has: [tcpout] indexAndForward = false ... View more

Define your index in your search from search head index= Also, verify that users roll has permissions to search that index (in Settings >> Access controls >> Roles) You can verify that the distributed search is quering both peers by checking the job inspector (after search, click on the "job dropdown") ... View more

1st easiest thing to start with is to download and install the S.o.S app (app link here) If you install this on your search head, remember to deploy the TA (Links here on the documentation tab) to your indexer(s). In the S.o.S. app, check out the "Estimated percentage of total CPU used per Splunk processor" panel under the "Indexing Performance" dashboard. This will let you view where most of your CPU processing time is going. most typically it is a bad regex. Then it is a matter of finding the bad regex that was put in place, through exploring your transorms.conf settings through the S.o.S. "Configuration File Viewer" view. ... View more

SHC Architecture link; this outlines the basics ... View more

start by going through this; http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Converttosinglesite ... View more

no, if your affected there is no way around it; you will have to update your outputs.conf or deploymentclient.conf after the install is complete. ... View more

There is a known issue for hanging installs on 6.0.1 http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues#Windows-specific_issues "Installing the Windows universal forwarder with the Deployment Server and Indexer fields populated can cause the installation to hang. Leave these fields blank and the installation will complete successfully. (SPL-78756)" ... View more

you get the installation downloads from http://www.splunk.com/download and configure the instance using the docs links above. ... View more

The documentation; will answer your question: http://docs.splunk.com/Documentation/Splunk/5.0.6/Installation/HowtoupgradeSplunk when upgrading to 5.0.x, going from 4.2.x is a supported path. Going to 6.x you have to be on 4.3+. There is also a list of things to consider and warnings on back ups before you update. The subtopics will answer questions around upgrade order for distributed environments and/or the order of forwarder upgrades in relation to your servers. ... View more

You can search the _internal index to see your splunkd and metrics logs. If you want anyone in particular,... index=_internal source=*metrics.log ... View more

You should check in your indexers splunkd.log and metrics.log to see what is going on with your indexer. Can't tell much from looking at one side of the issue. If you still don't get enough info you can crank up the logging on both sides to get more detail. method of increasing logging on inputs and outputs: http://blogs.splunk.com/2008/09/22/enabling-debug-messages/ ... View more

here you go: http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/ConfigureSplunktostartatboottime ... View more