Thanks! I also discovered that the brute force technique works too: rm -rf ../var/lib/splunk/fishbucket Not as elegante, but effective... ... View more

They are sourcetype leftover examples of simpler times. They can work on very generic datasets, but if you intend to ingest more specific logs, it's better to create new specific sourcetypes. (or use the ones provided by specific enterprise standard in their apps, and likely compatible with the Common Information Model). The reason is that, if you all many of your events have the same sourcetype, then the day you want to setup a custom filters/field parsing/index time or search time processing, it will apply to a large set of data. While if you apply it to a specific sourcetype, you can control better the scope. ... View more

i have, and built a dashboard so anyone can use it. Very useful. ... View more

You could ask your users to go to Settings > Server settings > General settings and look at the server name there when they have a problem. I am not aware of any tokens or officially supported way to get the server name to appear on the UI. All the best ... View more