I've added a new indexer to the cluster and I would like to force replication of some older archived indexes. I'm curious if there's a way to trigger Splunk to replicate the indexes, since they are not being written to anymore, or is it better for me to just copy the index files over? Also, any best practices on configuration for an archived index to ensure it's not wasting resources. Thanks in advance, David ... View more

I currently have a single Splunk server doing everything. I would like to move to a clustered environment. I have a second matching machine and a couple of smaller systems that should allow me to put the rest of a clustered environment together. My question is: Will a clustered environment work with a single indexer while I get the pieces functioning properly? I do understand that replication will not function until the second indexer is added to the cluster. Thanks, ... View more

I'm looking for a search that will let me check what forwarder revisions are installed on individual machines. Anyone know of one? Thanks, ... View more

So we have a script that runs tests to monitor if a system has changed and the output examples below are the lines I need to break before. This will allow us to easily display the results of the tests. None of the lines of data that include the results have the # preceding them, but they may have a # in the line somewhere. I am hoping someone might suggest a regex that will allow me to break the event appropriately. BREAK_ONLY_BEFORE=Regex Jan 17 15:07:58 hostname.test.com filename.pl # check USB access Jan 17 15:07:58 hostname.test.com filename.pl # check File name access access Jan 17 15:07:58 hostname.test.com filename.pl ##### filename.pl ##### Jan 17 15:07:58 hostname.test.com filename.pl ##### filename1.pl ##### Thanks for any thoughts. ... View more

Trying to delete data from an index for a specific day, and keep getting an error. index=os sourcetype=ps provides 600k results for a single day. index=os sourcetype=ps | delete results in "job terminated unexpectedly" "search terminated because of an error" Yes the account has the delete functionality. Thanks in advance for any thoughts. ... View more

What is the smallest license allocation that can be served from a Splunk license server? Is it possible that a multi-gigabyte license server can serve the license out to some systems as say 100mb chunks? Thanks, ... View more

Anyone with ideas on how to convert this rex search string into host_regex= input for the Host field, to be a host name in inputs.conf. rex "(?P<App>\S+)__(?P<Loc>\S+)__(?P<Host>\S+)__(?P<PID>\d+)." ... View more

I am trying to pull the hostname from file names, for inputs.conf. The hostname is always between the second and third set of double underscore characters the rest of the file name can be multiple groups of letters & numbers. The hostname can be made up of letters, numbers, and/or dashes If the hostname has dashes then there can be two, three, or four segments to the name, but it is always the total of what's between the double underscore. There can be multiple segments to the file name, both before and after the hostname. Example: field____field________field__________hostname_______field.log Thoughts? ... View more