How can i add a splunk server in Active Directory Domain. ... View more

I would like to see the list of all the Indexes along with the Earliest and Latest Time stamp for the most oldest log and most earliest log stored in that index. I used following qeuery but i take to much time to provide the resluts, is their any other method to see this information as quick as possible. index=* | stats first(_time) as latest last(_time) as earliest by index | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(earliest) ctime(latest) ... View more

Hi, What is the queury to identify conflicting buckets in an Index. ... View more

Hi have followed the following Splunk Restore archived data, but coudnot able to searched the restored data. Can any one please help me, is there any ohter way to restore archived data back into splunk. Restore archived data by moving the archive into the thawed directory, $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb. You can restore an archive to a Splunk server regardless of operating system with some restrictions -- data generated on 64bit systems is not likely to work well on 32 bit systems, and data cannot be moved from PowerPC or Sparc systems to x86 or x86-64 systems, and vice versa. Data in thaweddb is not subject to the server's index aging scheme (hot > warm> cold > frozen). You can put old archived data in thawed for as long as you need. When the data is no longer needed, simply delete it or move it out of thawed. The details of how to restore archived data depends on how it was archived. You can restore archived data to any index or instance of Splunk, with the caveat that you do not introduce bucket ID conflicts to your index. Archived data does not need to be restored to its pre-archival location. **nix users* Here is an example of safely moving a previously saved archive bucket to thawed. 1. Copy your archive bucket to the thawed directory. # cp -r db_1181756465_1162600547_0 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/temporary-db_255 Note: If the archived db was compressed, be sure to uncompress the contents in the temporary directory. 2. Rename the directory you just copied into the thawed directory to something that Splunk will recognize: cd $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/ mv temporary-db_1181756465_1162600547_0 db_1181756465_1162600547_0 Note: This examples assumes that the bucket id '0' does not conflict with any other bucket in the main (defaultdb) index. If it does, you will have to move the bucket to a non-conflicting bucket ID. 3. Refresh the manifests: cd $SPLUNK_HOME/bin ./splunk login ./splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests After a few moments, the contents of your newly thawed buckets should be searchable again. ... View more

Hi, I could not able to Restore archived data and could not able to make it searchable even after following Restore archived data instractions in Splunk Admin Manual. Can any one please help on this. ... View more

Hi, I have configured following parameters for testing the log Archiving for one of my index named "os". But it is not working as per the configured parameters as the data from hot+warm bukets is rolled to cold but the data has not rolled from cold buket to frozen achive location. Instead of that the cold buket size and number is keep on growing. Please do let me know if the parameters provide by me are worng or how can i test the logs are archiving on the given location. etc/apps/index.conf [os] homePath = $SPLUNK_DB2/os/db coldPath = $SPLUNK_DB2/os/colddb thawedPath = $SPLUNK_DB2/os/thaweddb coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os maxWarmDBCount = 5 maxHotBuckets = 1 maxDataSize = 10 maxTotalDataSizeMB = 1000 frozenTimePeriodInSecs = 1800 Storage bukets as per above parameters: 8.0K ./db/db_1329748885_1329748067_16/rawdata/.compressedAddresses 664K ./db/db_1329748885_1329748067_16/rawdata 824K ./db/db_1329748885_1329748067_16 8.0K ./db/db_1329749807_1329749597_18/rawdata/.compressedAddresses 200K ./db/db_1329749807_1329749597_18/rawdata 304K ./db/db_1329749807_1329749597_18 8.0K ./db/db_1329751849_1329749838_19/rawdata/.compressedAddresses 1.6M ./db/db_1329751849_1329749838_19/rawdata 1.8M ./db/db_1329751849_1329749838_19 8.0K ./db/db_1329749567_1329748907_17/rawdata/.compressedAddresses 508K ./db/db_1329749567_1329748907_17/rawdata 648K ./db/db_1329749567_1329748907_17 8.0K ./db/GlobalMetaData 8.0K ./db/hot_v1_21/rawdata/.compressedAddresses 3.3M ./db/hot_v1_21/rawdata 3.8M ./db/hot_v1_21 8.0K ./db/db_1329809830_1329751878_20/rawdata/.compressedAddresses 3.5M ./db/db_1329809830_1329751878_20/rawdata 7.1M ./db/db_1329809830_1329751878_20 15M ./db 8.0K ./colddb/db_1323792035_1323791901_8/rawdata/.compressedAddresses 244K ./colddb/db_1323792035_1323791901_8/rawdata 356K ./colddb/db_1323792035_1323791901_8 8.0K ./colddb/db_1328056408_1327030688_9/rawdata/.compressedAddresses 68M ./colddb/db_1328056408_1327030688_9/rawdata 135M ./colddb/db_1328056408_1327030688_9 8.0K ./colddb/db_1329748045_1329747137_15/rawdata/.compressedAddresses 780K ./colddb/db_1329748045_1329747137_15/rawdata 948K ./colddb/db_1329748045_1329747137_15 8.0K ./colddb/db_1329747107_1329746717_14/rawdata/.compressedAddresses 380K ./colddb/db_1329747107_1329746717_14/rawdata 508K ./colddb/db_1329747107_1329746717_14 8.0K ./colddb/db_1329746687_1329745996_13/rawdata/.compressedAddresses 636K ./colddb/db_1329746687_1329745996_13/rawdata 788K ./colddb/db_1329746687_1329745996_13 8.0K ./colddb/db_1297617319_1291336726_0/rawdata/.compressedAddresses 179M ./colddb/db_1297617319_1291336726_0/rawdata 399M ./colddb/db_1297617319_1291336726_0 8.0K ./colddb/db_1329737474_1328056434_10/rawdata/.compressedAddresses 107M ./colddb/db_1329737474_1328056434_10/rawdata 213M ./colddb/db_1329737474_1328056434_10 8.0K ./colddb/db_1312010101_1308010497_3/rawdata/.compressedAddresses 178M ./colddb/db_1312010101_1308010497_3/rawdata 402M ./colddb/db_1312010101_1308010497_3 8.0K ./colddb/db_1303821315_1297617349_1/rawdata/.compressedAddresses 117M ./colddb/db_1303821315_1297617349_1/rawdata 363M ./colddb/db_1303821315_1297617349_1 8.0K ./colddb/db_1322968195_1319178356_6/rawdata/.compressedAddresses 190M ./colddb/db_1322968195_1319178356_6/rawdata 395M ./colddb/db_1322968195_1319178356_6 8.0K ./colddb/db_1308010467_1303821327_2/rawdata/.compressedAddresses 176M ./colddb/db_1308010467_1303821327_2/rawdata 397M ./colddb/db_1308010467_1303821327_2 8.0K ./colddb/db_1323791855_1322968211_7/rawdata/.compressedAddresses 44M ./colddb/db_1323791855_1322968211_7/rawdata 96M ./colddb/db_1323791855_1322968211_7 8 .0K ./colddb/db_1329745010_1329737477_11/rawdata/.compressedAddresses 5.8M ./colddb/db_1329745010_1329737477_11/rawdata 6.4M ./colddb/db_1329745010_1329737477_11 8.0K ./colddb/db_1315568232_1312010124_4/rawdata/.compressedAddresses 197M ./colddb/db_1315568232_1312010124_4/rawdata 399M ./colddb/db_1315568232_1312010124_4 8.0K ./colddb/db_1329745970_1329745037_12/rawdata/.compressedAddresses 844K ./colddb/db_1329745970_1329745037_12/rawdata 1020K ./colddb/db_1329745970_1329745037_12 8.0K ./colddb/db_1319178335_1315568261_5/rawdata/.compressedAddresses 192M ./colddb/db_1319178335_1315568261_5/rawdata 400M ./colddb/db_1319178335_1315568261_5 3.2G ./colddb 8.0K ./thaweddb 3.2G . 3.2G total ... View more

Hi, I am testing automatic Log Archiving for my Splunk Deployment. i am testing this on one of my single index named OS. For auto Archiving i have configured "coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os" the location where i want to archive the data for OS index. Along with that i have configured following paramenter in my customizied Indexes.conf file to test Archiving by rolling data from hot/warm/cold to frozen to check some data at my archiving location.But i coud not able to see any data in my archiving location can any one please let me know where i am worng and how should i configre this ? [os] homePath = $SPLUNK_DB2/os/db coldPath = $SPLUNK_DB2/os/colddb thawedPath = $SPLUNK_DB2/os/thaweddb coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os maxHotBuckets = 5 maxHotSpanSecs = 3600 maxHotBuckets = 1 maxDataSize = 100 maxTotalDataSizeMB = 2000 frozenTimePeriodInSecs = 3600 ... View more

How can create a table containg date and time of oldest and most recent log per index in splunk ? ... View more

How do i identfy & troubelshoot windows hosts which have not forwared any log to splunk within last 2 weeks ? ... View more

Are there any Event codes for splunkd and splunkweb servers by which we can track there status ? ... View more

How i can denot the server being logged into in the banner message of splunk login page along with the banner text ? ... View more

How we can monitor and genrate daily or weekly Splunk Health Reports? Can Splunk daemon status be monitored? ... View more

I have found the following output after runing the following command. What does the out means ? host="xxx" | anomalies USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS root 1 0 0.0 00:00:00 0.0 684 10324 ? S 8-21:12:55 init [3] root 2 0 0.0 00:00:01 0.0 0 0 ? S 8-21:12:55 [migration/0] <noArgs> root 3 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [ksoftirqd/0] <noArgs> root 4 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [watchdog/0] <noArgs> root 5 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [events/0] <noArgs> root 6 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [khelper] <noArgs> root 7 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [kthread] <noArgs> root 9 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [xenwatch] <noArgs> root 10 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [xenbus] <noArgs> root 17 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [migration/1] <noArgs> root 18 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [ksoftirqd/1] <noArgs> root 19 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [watchdog/1] <noArgs> root 20 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [events/1] <noArgs> root 21 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [migration/2] <noArgs> root 22 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [ksoftirqd/2] <noArgs> root 23 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [watchdog/2] <noArgs> root 24 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [events/2] <noArgs> root 25 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [migration/3] <noArgs> root 26 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [ksoftirqd/3] <noArgs> root 27 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [watchdog/3] <noArgs> root 28 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [events/3] <noArgs> root 33 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [kblockd/0] <noArgs> root 34 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [kblockd/1] <noArgs> root 35 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [kblockd/2] <noArgs> root 36 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [kblockd/3] <noArgs> root 37 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [cqueue/0] <noArgs> root 38 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [cqueue/1] <noArgs> root 39 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [cqueue/2] <noArgs> root 40 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [cqueue/3] <noArgs> root 44 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [khubd] <noArgs> root 46 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [kseriod] <noArgs> root 126 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [pdflush] <noArgs> root 127 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [pdflush] <noArgs> root 128 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [kswapd0] <noArgs> root 129 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [aio/0] <noArgs> root 130 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [aio/1] <noArgs> root 131 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [aio/2] <noArgs> root 132 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:55 [aio/3] <noArgs> root 262 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:52 [kpsmoused] <noArgs> root 316 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:51 [ksnapd] <noArgs> root 319 0 0.0 00:00:01 0.0 0 0 ? S 8-21:12:51 [kjournald] <noArgs> root 348 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:50 [kauditd] <noArgs> root 377 2 0.0 00:00:00 0.0 1804 13524 ? S 8-21:12:49 udevd -d root 843 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:44 [kmpathd/0] <noArgs> root 844 1 0.0 00:00:00 0.0 0 0 ? S 8-21:12:44 [kmpathd/1] <noArgs> root 845 2 0.0 00:00:00 0.0 0 0 ? S 8-21:12:44 [kmpathd/2] <noArgs> root 846 3 0.0 00:00:00 0.0 0 0 ? S 8-21:12:44 [kmpathd/3] <noArgs> root 872 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:43 [kjournald] <noArgs> root 874 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:43 [kjournald] <noArgs> root 876 0 0.0 00:00:00 0.0 0 0 ? S 8-21:12:43 [kjournald] <noArgs> root 1340 0 0.0 00:00:00 0.3 14200 24000 ? S 8-21:12:39 restorecond <noArgs> root 1350 3 0.0 00:00:00 0.0 604 5888 ? S 8-21:12:39 syslogd -m_0 root 1354 3 0.0 00:00:00 0.0 424 3780 ? S 8-21:12:39 klogd -x root 1368 0 0.0 00:00:01 0.0 556 14528 ? S 8-21:12:39 mcstransd <noArgs> dbus 1379 0 0.0 00:00:00 0.0 892 31488 ? S 8-21:12:39 dbus-daemon --system root 1431 2 0.0 00:00:04 0.0 1256 65936 ? S 8-21:12:39 bash /usr/sbin/xe-daemon_-p_/var/run/xe-daemon.pid root 1510 0 0.0 00:00:01 0.1 6616 148276 ? S 8-21:12:38 snmpd -Lsd_-Lf_/dev/null_-p_/var/run/snmpd.pid_-a root 1525 0 0.0 00:00:00 0.0 1216 60524 ? S 8-21:12:37 sshd <noArgs> root 1535 0 0.0 00:00:00 0.0 1212 74812 ? S 8-21:12:37 crond <noArgs> root 1546 1 0.0 00:00:00 0.0 312 58900 ? S 8-21:12:37 rhnsd --interval_240 68 1556 0 0.0 00:00:00 0.0 3276 30260 ? S 8-21:12:37 hald <noArgs> root 1557 1 0.0 00:00:00 0.0 1008 21648 ? S 8-21:12:37 hald-runner <noArgs> root 1569 0 0.0 00:00:00 0.0 532 3780 ? S 8-21:12:36 agetty xvc0_9600_vt100-nav root 12893 3 0.0 00:00:00 0.0 428 3764 ? S 00:25 sleep 60 s-splunk 12900 2 0.0 00:00:00 0.0 1136 63844 ? S 00:00 sh /opt/splunk/etc/apps/unix/bin/ps.sh s-splunk 12913 0 0.0 00:00:00 0.0 932 65600 ? R 00:00 ps -wweo_uname,pid,psr,pcpu,cputime,pmem,rsz,vsz,tty,s,etime,args s-splunk 12914 3 0.0 00:00:00 0.0 540 58904 ? S 00:00 tee /dev/null s-splunk 12915 2 0.0 00:00:00 0.0 1056 63912 ? S 00:00 awk {NR_==_1_&&_$0_=_header}_{sub("^_",_"",_$1);_if_(NF>12)_{args=$13;_for_(j=14;_j<=NF;_j++)_args_=_args_"_"_$j}_else_args="<noArgs>";_sub("^[^\134[:_-]*/",_"",_$12)}_(NR>1)_{if_($4<0_||_$4>100)_$4=0;_if_($6<0_||_$6>100)_$6=0}_{if_(NR_==_1)_{print_$0}_else_{printf_"%-14.14s_%6s_%4s_%6s_%12s_%6s_%8s_%8s_%-7.7s_%1.1s_%12s_%-18.18s_%s\n",_$1,_$2,_$3,_$4,_$5,_$6,_$7,_$8,_$9,_$10,_$11,_$12,_args}}_header=USER_PID_PSR_pctCPU_CPUTIME_pctMEM_RSZ_KB_VSZ_KB_TTY_S_ELAPSED_COMMAND_ARGS s-splunk 18321 3 0.1 00:00:48 1.2 51700 179848 ? S 12:17:48 splunkd -p_8089_restart s-splunk 18322 3 0.0 00:00:02 0.1 7112 47060 ? S 12:17:48 splunkd -p_8089_restart s-splunk 18388 2 0.0 00:00:00 0.6 28560 671264 ? S 12:17:38 python -O_/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/root.py_restart ... View more

why do i get the following error ? Error loading file: Error loading file: /static/app/SplunkEnterpriseSecuritySuite/ammap/ammap_settings.xml ... View more

How can i customize banner text on login page. ... View more