In case you haven't noticed, this is a really old thread. Your question might not get the visibility you want in this thread. Try starting a new thread describing your problem in the Getting Data In section of this forum. ... View more

I know this topic may be old but I wanted to add, that this solved my scripted input problem too.    I had a script in which I change some things and then want to restart splunk - only with the statement /opt/splunkforwarder/bin/splunk restart > /dev/null 2>&1  it works perfectly. otherwise, when I leave 2>&1 out it results in splunk stopping but simultaneously killing the skript process too. so splunk can't come up anymore. so, thanks for that valuable information ... View more

Thanks! This is what I was originally trying, my mistake was not declaring: TIME_PREFIX="timestamp": ... View more

You can also try this: src_IP=192.168.1.0/24 ... View more

Thanks gfuente! This helped me! Thank you all! :) ... View more

I have seen it get caught up in about twenty minutes or so. I would recommend you look at Splunk on Splunk to get a better idea what errors are being reported. Very Nice well thought out app. ... View more

Thanks for helping, i am now successfully override the sourcetype of fortigate, and my config are: input.conf [udp://514] connection_host = dns sourcetype = syslog props.conf [syslog] TRANSFORMS-sourcetype_and_host_override = fortigate SHOULD_LINEMERGE = false transforms.conf [fortigate] DEST_KEY = MetaData:Sourcetype REGEX = fortigate FORMAT = sourcetype::fortigate But how can i override the sourcetype if i have another host come from udp514? thanks ... View more

Have you ever seen anybody setting the host=ip on inputs.conf? I wonder if the events themselves always have the hostname or computer name value in them and we can add the IP address via inputs.conf. ... View more

In that case, I might look at "mvexpand". The props / transforms that I described above creates a multi-valued field. mvexpand takes each of those values and splits it into its own event. http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Mvexpand ... View more

There is not folder like this when I install app. Folder is splunk_app_for_nix. Its not reflected in documentation. Also there is no setup.sh in bin folder, so how should I enable inputs? ... View more

I am going to glom onto this post and try to get better details then "depends" to the question. I understand that all outliers depend.. but lets keep this simple. *NIX app How do you do deployment across a cluster designed NSPOF: 4 x Indexer 1 x Cluster mater 1 x Deployer / license server 3 x Search nodes in SH Cluster (VIP for HA) 2 x Heavy forwarders collecting syslog /snmp / json (VIP for HA on inbound) I did read Documentation: http://docs.splunk.com/Documentation/Splunk/6.2.5/DistSearch/HowconfigurationworksinSHC Design for file location: splunkcmaster01 -> /opt/splunk/etc/masterapps/ (used for index node component deployment) splunkdeploy01 -> /opt/splunk/etc/shcluster/apps/ (used for Search Head Cluster Nodes) -> /opt/splunk/etc/deployment.apps/ (Forwarders) Example: *NIX app deployment (via best practice) Step 1: Download splunk-app-for-unix-and-linux_503.tgz onto splunkdeploy01 Step 2: copy files from within tarball out to different splunk directories [root@splunkdeploy01 /]# cd /tmp/ [root@splunkdeploy01 tmp]# cp /media/labfiles/Software/Splunk/apps/splunk-app-for-unix-and-linux_503.tgz . [root@splunkdeploy01 tmp]# tar -zxvf splunk-app-for-unix-and-linux_503.tgz [root@splunkdeploy01 tmp]# cd splunk_app_for_nix/ ?? < missing explaination of what dir / files goes where. I think /SA-nix goes in one folder and /TA_nix goes in another folder but also some parts go onto search head. > ?? [root@splunkdeploy01 /]# ls /tmp/splunk_app_for_nix/install/ SA-nix Splunk_TA_nix Question: 1) README.txt within app has no info to guide on this procedure. And docs website does not speak to cluster type deployment. Is there a guide for or youtube for how this is done? Once I get the answer for this I can post this.. and as I crawl through other apps deploy on cluster.. I can post that. (example DB connect , Exchange, VWare etc.. which say a lot of "deploy like standalone" but peices to the process are missing... or I am missing the "Very F*ine* Manual" ... View more

This step is for the TA-SMTP-reputation component (as per step 6) since a full Splunk install has the required Python components to check SMTP server reputation. Keep in mind that this heavy forwarder install will take up resources separate from your indexing tier. Installing the TA-SMTP-Reputation component on your indexing tier is not supported. Another option is to install a heavy forwarder on one of your Exchange servers to handle this requirement, but again, not recommended due to resource requirements. Thanks, Jeff. ... View more

I downvoted this post because not working at all ... View more

Hello, We have configured syslog server but looking for solutions to make it highly available. Can you provide some direction on that. Currently I am looking into HA Proxy and Pacemaker. Thanks Hemendra ... View more

Yes, where they reside depends on what app context they are saved under. In this case, they were saved while in the default app "Searching & Reporting". ... View more

I can verify I have seen other customers push certs via APPS and then just update the path in a .conf file in that app. You can even reference the certs with ./ I know a place that has been doing this since the 5.x days ... View more

Msiexec.exe /a did not work. However, msiexec.exe /i splunk.msi /qn AGREETOLICENSE=yes did work. It threw a couple off errors but at the end it installed. ... View more

multi-line ... View more

On a computer with the Universal Forwarder installed. Click start->Run->regedit Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Edit->Find then enter splunk In that key you will see the UninstallString. Double click and copy that value. Click start->Run-> cmd at cli right click and paste that value. add /qn at the end of that string to silently uninstall. Ex. for ver 5.0.2.149561 Win7 MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn If you want to push this remotely there are many ways. I like psexec. Google pstools to download. Example installer below. You could modify for the uninstaller. Running this in a bat file or from cli will open a new cmd prompt to uninstall. Let it finish with an exit code before closing. start cmd /k psexec \\#ipadd# -u "domain\domainadmin" -p "password" msiexec.exe /i "\\server\SplunkForwarder\splunkforwarder-5.0.2-149561-x86-release.msi" RECEIVING_INDEXER="splunkserver:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 AGREETOLICENSE=Yes /quiet ... View more

Ahh, thanks for letting me know. I emailed support and they just released it. ... View more

after i "splunk restarted" them all, twice. they showed up.... ... View more

Let's update this for 2019! It seems to come up a lot in google results, and since I originally wrote this in 2015 "things have changed". Splunk environments are larger and more complex, and honestly I know more about scaling clusters than I did then. A very small cluster (3-4 indexers, 500GB a day or so) would likely be fine with the below specs. In 2019, I would make sure that my cluster master is similar in specs to my indexers - except for the disk space requirement. The CM does not need a lot of disk, but it can use lots of CPU and lots of RAM. Every bucket in the cluster has state that must be kept in the CM's RAM, and the status of those buckets must be updated as things on the cluster happen. There's a saying, "More Buckets More Problems" so be aware that CM scaling and tuning is partly a function of the number of buckets in your cluster. FIrst of all you should follow what the Splunk docs say as far as hardware requirements! Beyond that, a good reference is Da Xu's and Chloe Yeung's .conf talk "Indexer Clustering Internals, Scaling and Performance Testing". See the slides and video from .conf 2018. Old answer from 2015 follows, please don't try to use this unless you're reading this from a time machine in 2015: The hardware requirements for a cluster manager really are small. Search concurrency does play a part as does the number of indexers. The primary role of the cluster master is to coordinate which indexer houses the "primary" copies of buckets and which indexer(s) hold the "backup" copies. If your cluster master is dedicated exclusively to this task (and it should be) then any small-to-medium size cluster should be able to get by with 2 cores and 4GB of RAM. Even if the rest of your Splunk installation is on "bare metal", a cluster master is a good candidate for a small virtual machine. ... View more

Yes, that is correct. ... View more

Yes, but how do I do that with SSL enabled ? We already have that working without SSL. ... View more