we have a lot of operational data that comes into Splunk, and based on certain conditions this can cause a service impact.  These conditions then trigger alert actions which update our Remedy and NMS tools.  my question is how do other Splunkers handle this? I've typically done, run on cron schedule every 1 min and look back by1 min. Is this the correct way to do it? I've ran into some issues where events get dropped due to index processing taking a bit more time, and it gets pick up on the sequential alert. I really want to utilize the data in Splunk to update  help desk tickets, triage service outages, and all of that cool integration stuff, but I want to make sure I'm writing my alerts properly. ... View more

I'm trying to install a universal forwarder on one of my systems. I originally tried with the main Linux package in the link below however I came to find out that my system isn't x86_64 but it's i686.  http://www.splunk.com/download/universalforwarder Is there a UF that is supported for i686 architecture? I don't care if it's an older release if it does exist ... View more

I'm going to describe a typical use case.   The Software team will have one log file for most of it's outputs, lets call this HOUSES. This data will be generic health status information, transaction information, and some times data payloads in XML and some data in JSON. My practice has been to use a UF to monitor that file. Then on the Indexers i'll use Props to go through that data and set my time, linebreakser, and transforms.  Then in my transforms I use REGEX to match UNIQ fields in the data like, for example, RED-HOUSE. This will grab all data from that original file that contains RED-HOUSE. I then do a sourcetype override and make the new source type HOUSES:RED-HOUSE.  Then on my Searchhead i'll define my props/transforms (Using EXTRACT/REPORT) for field extractions.  I'll try to show a brief example:   Data: lets say sourcetype is LOGS   dcnsnoctads-1 2021/02/12 01:59:59.105 GMT-FANS ADS START PERIODIC PERIODIC TIMER_START .D00002 ​ dcnsnoctads-1 2021/02/12 01:59:59.105 GMT-FANS ADS SEND PERIODIC CONTRACT REQUEST #502, .D00002 ​ dcnsnoctads-1 2021/02/12 01:59:59.105 GMT-FANS ADS PERIODIC PERIODIC CONTRACT TIMER_EXPIRED 0,.D00002   On indexing Tier: Props:   [LOGS] SHOULD_LINEMERGE = False TRANSFORMS-ADS = ADS, EFG, XYZ   Tranforms:   [ADS] REGEX = ADS DEST_KEY = MetaData:sourcetype FORMAT = sourcetype::LOGS:ADS     Search head: props:   [ADS] REPORT-ADS = ADS_EXTRACTIONS   (lets assume several data points use the same extraction, so REPORT should be used  TRANSFORMS:   [ADS_EXTRACTIONS] REGEX = ADS (?P<ADS_Method>\w+\s\w+)\s(?P<ADS_Method_Type>\w+)\s(?P<Method_Message>\w+)(?:.*)(?P<tail_no>.{7}$)       Is this overkill? Or is this taking the right approach? I basically try to make a sourcetype for every differential of field extractions format there is.  ... View more

I have inherited a SPlunk environment and one thing i've noticed is that one all of our heavy forwarders are using useACK.  Is this best practice? we are seeing duplicate events due to this, and I wanted to see if I should work on tailoring the config for indexer acknowledgement, or if I should just disable it and move on.  ... View more

I followed this article https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Advancedsourcetypeoverrides basically I took sourcetype ABC and am doing some regex and searching for 123, if I find that in the event I change the sourcetype to ABC:123. Now for this new sourcetype there is some wonky event breaking. Can I then create a new props entry [ABC:123] and perform all my line breaking and time extracting like I would for any normal event? As of right now it doesn't seem to be working.  I have:     2021-01-26 00:00:44.2885 [INFO] [NT AUTHORITY\SYSTEM] SIXPACService.SplunkForwarder.SplunkWriter Attempting to Splunk Message from SITA: <?xml version="1.0" encoding="utf-8"?> <DCNSMessage>   and with the following props for testing: [ABC:123] LINE_BREAKER = SIXPACService.(.*)   and nothing happened when I tried that props. any ideas? ... View more

the problem i'm currently having: Software team has logs being written to a file of mixed format and structure. I'm trying to use dynamic sourcetypes so that I can place these into sourcetypes and then do the proper field extractions. I have followed this article: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Bypassautomaticsourcetypeassignment   But it doesn't seem to be working. here is my current config:   props.conf: [source::C/Windows/SysWOW64/SIXPAC/SIXPAC/*.log] TRANSFORMS=SIXPAC = sixpac_service   transforms.conf [sixpac_service] SOURCE_KEY = MetaData: source REGEX = SIXPACService\.(.+)\.(.+)\s FORMAT = sourcetype::SIXPACService.$1.$2 DEST_KEY = MetaData:Sourcetype   Anyone have some ideas as to why this isn't working?   ... View more