I have data coming from syslog udp:514 but I want to send some events to a different index. Depending of : the host they are coming from : ftp or vpn should go to indexB some keywords in the events. "AUDIT" or "ALERT" should go to indexC ... View more

I removed a server from my cluster, and it still shows up in the dropdowns of the SOS app. How is it maintained, can I reset the list ? ... View more

I have a farm of Windows Boxes, and it's a pain to figure which versions of IE they are running on. The only place I found the versions are in the registry, Can I use splunk to collect the versions per host ? ... View more

I have to do some maintenances in splunk and want to warn the users that splunk will be down. How to get the list of active users logged in ? There is a message bar, can I post messages to it ? ... View more

My index has a retention of 6 months with frozenTimePeriodInSecs=15552000. But I still see some events that are older than the retention. By example events that are from 6 month and 2 weeks. Any thoughts ? ... View more

After upgrading to Splunk 6, I started to notice that the deployment-client was disabled on my deployment-server instance. FYI my deployment-server is also a deployment-client of itself. I found this error in splunkd.log on the server ERROR DC:DeploymentClient - This DC shares a Splunk instance with its DS: unsupported configuration. It was working before in 5., it is not working anymore in 6. ? ... View more

To limit the indexing of some WinEventLogs, I was using a nullQueue filter at indextime as described here : http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad#Filter_WMI_events It helps limiting the volume, and getting rid of some useless events. On the forwarder in inputs.conf [WinEventLog:Security] disabled=false on the indexers in props.conf [WinEventLog:Security] TRANSFORMS-myWonderFilter=getRidOfThoseEventCodes and in transforms.conf [getRidOfThoseEventCodes] REGEX=(?m)^EventCode=(592|593|594|1523) DEST_KEY=queue FORMAT=nullQueue It works, but the events are still collected and forwarded. I heard about a new method in splunk 6.* to filter at the forwarder level. Any examples ? ... View more

I was using dbinpect to calculates the first and last events in my buckets. In splunk 4.* and 5.*, it was returning 2 fields earliestTime and latestTime as a date in my SH timezone. But I do not find those fields anymore in 6.*, how to get them ? ... View more

I installed Splunk Universal forwarder on Windows (2008 rc2), but when I tried to upgrade or to uninstall, it failed. Error 1321. The Installer has insufficient privileges to modify the file D:\Program Files\SplunkUniversalForwarder\etc\system\metadata\default.meta It seems to be linked to the MSI installer. I checked the file it's locked, and there are no visible owner or permissions, even windows doesn't know how to display it. ... View more

Report acceleration is failing because splunk cannot create the folder for the summary (summaryHomePath ). This seems linked to my custom homePaths. It works for this index, and the folder /opt/splunk/var/lib/splunk/index1/summary is created. [index1] homePath=$SPLUNK_DB/index1/db coldPath=$SPLUNK_DB/index1/colddb thawedPath=$SPLUNK_DB/index1/thaweddb It fails for this one, and no folder /summary is created. [index2] homePath=/index2db coldPath=/index2_colddb thawedPath=/index2_thaweddb ... View more

Since I upgraded to 6.0, I see this warning Possible typo in stanza [splunktcp-ssl:9997] in /splunk/etc/system/local/inputs.conf, line 5: compressed = true Did you mean 'concurrentChannelLimit'? Did you mean 'connection_host'? ... View more

In splunk 4.* and 5.* I used to have Splunk Universal forwarders on Windows Domain Controllers. The volume of events on the channels : Security, Application, System etc... were high during the daytime, and the forwarder couldn't keep up. Over the day, we were experiencing delay between the events timestamp and the _indextime (once indexed and searchable). And during the night the events were catching up. You could see the behavior with a search like this for the previous day : sourcetype=WinEventLog host=myhost | delay_sec=_indextime-_time | timechart avg(delay_sec) by sourcetype But since I switched to Universal forwarders on 6.0, things started to get better. What magic happened ? PS : To boost speed : - We already removed the default thruput limit, and were having unlimited speed in limits.conf [thruput] maxKBps=0 - and the AD object name resolver was the local AD. ... View more

I am monitoring with a forwarder logs file that are being written. And sometimes the events indexed are broken in multiple events in the middle of the line : example : Thu Sep 19 17:13:32 PDT 2013 myhost my event and the end of my line becomes event1 : Thu Sep 19 17:13:32 PDT 2013 myhost my event and event2 the end of my line ... View more

In stats calculation, I use average avg() and median but I saw other people using "percentage Xth" like perc95(). What does it do exactly ? see docs http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Commonstatsfunctions This function returns the X-th percentile value of the field Y, where X is an integer between 1 and 99. The functions perc, p, and upperperc give approximate values for the integer percentile requested. The approximation algorithm used provides a strict bound of the actual value at for any percentile. The functions perc and p return a single number that represents the lower end of that range while upperperc gives the approximate upper bound. exactperc provides the exact value, but will be very expensive for high cardinality fields. ... View more

I have a windows forwarder deployed to collect the logs from a Xen app device, and this scripted powershell input doesn't return anything. $SPLUNK_HOME\etc\apps\TA-XA65-Server\bin\powershell\GetXAServer65.ps1 But I can see that is ran in splunkd.log INFO ExecProcessor - Ran script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\Splunk\etc\apps\TA-XA65-Server\bin\powershell\GetXAServer65.ps1'" -index xenapp, took 45.94 seconds to run, 876 bytes read ... View more

I signed up to Splunk or Storm and had to accept the commercial emails to finalize my sign-up. How to unsubscribe to the emails ? ... View more

I have large logs, with more than 10000 chars per line, and multiline events as large as whole XML file. They are always truncated or cut in multiple events because too long. It seems that the default is MAX_EVENTS=250 TRUNCATE=10000 Can I push them to unlimited (i.e. 0)? ... View more