The Rcv from external IPs are showing incoming packets from external DNS servers. The DNS server you're monitoring is performing recursive queries, so it has to get the answer for external domains from an external DNS server. Your log is showing you all incoming and outgoing DNS packets.,The Rcv lines from external addresses are showing you responses from external DNS servers. Since the DNS server you're monitoring is a recursive resolver, it will ask other DNS servers on the Internet for answers. The log is just showing you all the incoming and outgoing packets related to the query. ... View more

for context, please see the other Answer to this question. ... View more

Yes, there is an example of connecting to Postgres over SSL here: http://splunk-base.splunk.com/answers/68899/dbx-connection-to-postgressql-error-ssl-off For MySQL it requires exporting the database certificate and importing it into the trust store of the JVM powering the JavaBridge. ... View more

Try | metadata type=hosts, this will give you am good overview ... View more

Well, I guess that you could either a) define the license master as a search peer for all your search heads, or b) configure the license master to forward its _internal logs to the indexer(s). In case b) you'd then be looking at index=_internal host=your_license_master instead of splunk_server /k ... View more

You are correct. In the current version of the API (5.0.2), only total index usage, not per volume, is reported. Furthermore there is no interface that I am aware of that reports on volume usage (whether actual disk volumes or Splunk indexes.conf-defined logical volumes) ... View more