If I go into the License Manager, it shows me a simple progress bar of "Volume used today". For pool "auto generated pool enterprise", I see (for example) "Volume used today" of 3,389 MB / 10,241 MB (at 10:04 AM). What I'm looking for is very simple: I want to know this value for the last N days. I want to know, at 23:59:59, I was at 9,506/10,241 on Monday, 10,506/10,241 on Tuesday, 10,103/10,241 on Wednesday, and so forth. There are many answers addressing daily log volume, and none provide this simple level of answer. One actually suggests that this type of graph used to be available but no longer. I do have the Deployment Monitor app and the Splunk License Usage app installed, both are useful at seeing the breakdown of where logs are coming from, but don't give me this simple daily high water mark that I'm looking for. It shouldn't take rocket science to be able to say to my boss "our daily usage has trended from 85% to 95% average capacity over the last two months, so give me money for more licenses." Any help out there for simple summaries of daily volume? ... View more

I'm trying to monitor files on a Windows server and it isn't working. I've placed a few stanzas like this into etc/deployment-apps/Exchange/local/inputs.conf: [monitor://D:\Microsoft\Exchange Server\V14\Logging\RPC Client Access\*.log] disabled = false followTail = 1 sourcetype = exchange I've verified that the deployment server is pushing this app out to the server. I've verified that the path is correct. I've verified that log files in the directory, including the currently open log file, can be opened up with 'notepad'. I've verified that the Universal Forwarder was restarted after the app was verified as in place. I pushed the app to a second server and manually created a log file at the appropriate path, and that promptly showed up in Splunk. So it doesn't appear to be syntax or anything. What else can I do to debug this? Is there a splunk log somewhere that might talk about what it sees for files, tries to open, and any errors that crop up along the way? Update after following jbsplunk's note: The FileStatus link was very useful. I can now see that two things are happening: 1) Some files are being indexed, but instead of sourcetype 'exchange', they're logging under sourcetypes 'exchange-103' and 'exchange-112'. Any idea why the sourcetype I've specified in my monitor stanza is being modified? 2) Other files are not being matched, possibly because *.log doesn't match *.LOG. Is it the case that Splunk monitor path specifications are case sensitive on Windows where the filesystem is case insensitive? (angle brackets replaced with {} due to HTML rendering conflict with forum) {s:key name="D:\Microsoft\Exchange Server\V14\Logging\RPC Client Access\RCA_20120208-1.LOG"} {s:dict} {s:key name="parent"}D:\Microsoft\Exchange Server\V14\Logging\RPC Client Access\*.log{/s:key} {s:key name="type"}File did not match whitelist '^D:\\Microsoft\\Exchange Server\\V14\\Logging\\RPC Client Access\\[^\\]*\.log$'.{/s:key} {/s:dict} {/s:key} ... View more

I'm trying to debug some issues with the deployment server. This causes me to want to run things like 'splunk display deploy-client' on the forwarder, but when I do so it asks for credentials: [root@frwrdr ~]# splunk display deploy-client Splunk username: I do not know what credentials it will accept. If I do this on the indexer/search head, then my normal Splunk credentials (which are backed by LDAP authentication) work. However, that is not the case on the forwarder host. Nor do my local credentials on the forwarder host work. What should I be doing here? Setting a password for the local 'splunk' user and using that? ... View more