I've followed the installation instructions for FreeBSD but am not able to start splunk as a non-root user upon boottime. root@fbsd3:~ # $SPLUNK_HOME/bin/splunk enable boot-start -user splunk Shared object "libxml2.so.11" not found, required by "splunkd" Shared object "libxml2.so.11" not found, required by "splunkd" Shared object "libxml2.so.11" not found, required by "splunkd" Did not find "disabled" setting of "kvstore" stanza in server bundle. Can't create RC file "/etc/rc.d/splunk": Permission denied root@fbsd3:~ # su - splunk splunk@fbsd3:~ % $SPLUNK_HOME/bin/splunk enable boot-start -user splunk Can't create RC file "/etc/rc.d/splunk": Permission denied But I'm able to run splunk fine as the user splunk: splunk@fbsd3:~ % /opt/splunk/bin/splunk start Splunk Like an F-18, bro. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary Done Checking filesystem compatibility... Done Checking conf files for problems... Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Waiting for web server at http://127.0.0.1:8000 to be available. Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://fbsd3.domain.local:8000 ... View more

I have a sourcetype that has multi-line events. An example looks like this: Jan07 12:45:18.57 | [Info ] | This is the message I want Stuff : foo More Stuff: bar I can successfully pull out my desired data using rex during a search with: rex field=_raw "\[Info\s\]\s\|\s(?<msg>.*)" When I use the same regex in manager->fields it doesn't work. It actually grabs everything in the event all the way to the end and doesn't stop at the end of the line. However when I use the interactive field extractor it works as expected and highlights only the message I want to extract. How do I make it stop at the end of the line rather than the end of the event? ... View more

On my universal forwarder inputs.conf I have: crcSalt = for C:\TEMP. When I add a file it's consumed and sent to my indexer. Then I remove the file from C:\TEMP, restart the universal forwarder and re-add the same file (with the same filename) to C:\TEMP. When I do, it's not consumed again. Isn't crcSalt supposed to allow this? It seems like crcSalt is almost working because when I simply change the filename and add it to C:\TEMP the file is indexed again. Am I mistaken? Shouldn't crcSalt = allow me to index the exact same file with the same filename more than once? In my inputs.conf I have SOURCE capitalized. For some reason I can't capitalize in the question. ... View more