You will want to setup the search heads to forward the logs to the indexers via outputs.conf and restart. Once you add that you will need to re-run the server_lookup_v6_1. Alternatively, you can set them up as search peers but it is best practice to have all components log their internal logs to the indexing tier. ... View more

Are your search heads forwarding their logs to the indexing tier? ... View more

You should not need to add them as search peers if you have the app installed on the master node. Splunk 6.2 offers several rest endpoints that the app takes advantage of to assign server roles but for 6.1.x you will need to enable the server_lookup_v6_1 saved search to populate the host information. A new version of the application is currently in the works and will be released shortly. ... View more

The settings actually work. If you noticed, your timestamp is in the future... 1429306200000 equates to Fri, 17 Apr 2015 21:30:00 GMT ... View more

Update this metadata entry in $SPLUNK_HOME/etc/system/local/limits.conf to a higher value. [metadata] maxresultrows = <integer> * the maximum number of results in a single chunk fetched by the metadata command * a smaller value will require less memory on the search head in setups with large number of peers and many metadata results, though, setting this too small will decrease the search performance * default is 10000 * do not change unless instructed to do so by Splunk Support maxcount = <integer> * the total number of metadata search results returned by the search head; after the maxcount is reached, any addtional metadata results received from the search peers will be ignored (not returned) * a larger number incurs additional memory usage on the search head * default is 100000 ... View more

Assuming you're on Splunk 6.x, something like the following should do the trick. Also, do you care about the index as a whole or the different sourcetypes within it? | tstats latest(_time) AS lastTime WHERE index=A OR index=B OR index=C BY host sourcetype index | eval current=now() | eval age_min=round((current-lastTime)/60,2) | rangemap field=age_min default=severe low=0-30 elevated=30-60 | stats max(current) AS "Current Time" values(sourcetype) AS Sourcetypes list(lastTime) AS "Latest Event" list(age_min) AS age_min list(range) AS Status by host | convert ctime(*Time) ctime("Latest Event") | eventstats avg(age_min) AS avg_age by host | eval avg_age=round(avg_age,2) | sort - avg_age | rename age_min AS "Communicated Minutes Ago" avg_age AS "Avg Communicated Minutes Ago" ... View more

On the DS you should be able to run | rest /services/deployment/server/clients to generate a base search to cleanup/filter then export. ... View more

If you are unsure if sstime wont be in the message the you could just set it to: LINE_BREAKER = ^\{ Which will tell Splunk to break a new event if the beginning of the line begins with a "{". Go ahead and add this into a new props.conf and let me know how it works for you. ... View more

You will want to restart your indexer after the change also this wont apply to events that have already been indexed. ... View more

In the app where your props.conf is defined you will need to check your default.meta to ensure it is readable to all users and not just admin. For example: [] access = read : [ * ], write : [ admin ] export = system Meaning allow everything in this app context to be viewable by everyone but can only be modified by the admin user. This also means that the knowledge objects in this app are shared globally for the whole system. http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Defaultmetaconf ... View more

Give rex a shot: | rex mode=sed field=MSISDN "s/(^0)/999/g" ... View more

I am on 6.1.2 ... View more

limits.conf requires a restart for the changes to take hold http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/limitsconf If you place limits.conf in the local directory of any deployment app and have restartSplunkd = true for your particular serverclass in serverclass.conf you should be set. ... View more

Can you provide some of the sample data and the fields you are trying to pull out? ... View more

Have you checked the eventtypes? The app relies heavily on them and by default these don't always point to the correct indexes where your data is located. ... View more