I have a 10GB Indexing License, which for the first time we have exceeded the limit. I know for sure exactly which input that caused this, and I would like to know if there is a way to tell Splunk to stop this indexing input from this data if the license quota hits 90%. This data is coming directly from tcp, so the data will be lost but this is preferred over the other data on the system. Is there any way to do this? Thanks. ... View more

Currently I am trying to write a python script that I can use to permute the input. I then wish to use this as a command to generate my output. What I want from the search app: Run search "host= | permute 123" Then my permute script will return "123 OR 132 OR 213 OR 231 OR 312 OR 321" so that my final search will be "host= 123 OR 132 OR 213 OR 231 OR 312 OR 321" Is this sort of thing possible? I have been working on developing a view for an app to execute this in. My idea was to run the permute with the input given from a text field and then put the results of the permute into the next search. I have looked through many of the Splunk documentation and forums and cannot figure out what to do. I though $results$ would give me the results of the first search but this has not worked. Any ideas? Thanks! ... View more

Setup currently I have the newest version of Splunk (6.0) running as my main Splunk server with several universal forwarders v 6.0 sending logs to the server to be indexed. I have another box that the v 6.0 forwarders are incompatible with so I need to install Splunk version 3.14 onto the box. I see in the documentation that I can make the full installation a heavy forwarder to push to my regular indexer, but it is not working for me. Steps Taken: I Installed the full Splunk v 3.14 on the box I want to use a forwarder Then enabled the forwarder: ./splunk enable app SplunkForwarder -auth <username> : <password> Started forwarding activity: ./splunk add forward-server <host> : <port> -auth <username> : <password> Added deploy server: ./splunk set deploy-poll <host> : <port> Retarted splunk: ./splunk restart Waited but the forwarder never appears in the list under Forwarder Management on the Splunk Server I assume this has something to do with the different versions of Splunk that I am using, but the documentation says: "All indexers are backwards compatible with any forwarder and can receive data from any earlier version forwarder." Anyone else have this problem or know how to better implement this? Documentation: Heavy Forwarder Doc Forwarder and Indexer Compatibility ... View more

I have a Windows 2000 box that we would like to install a universal forwarder on to push to our Splunk server that is already running with other forwarders configured to it. The problem is that I cannot find a universal forwarder that is compatible with Windows 2000. I have installed a version of Splunk on it, but I do not want it to index the data or interfere with the license of the other server. Optimal solution is to be directed to a universal forwarder that is compatible with Windows 2000. I see Splunk Universal Forwarder on Win2000? but I was hoping that since 2011 we have a better solution. ... View more

I have a comma separated csv file with missing headers. From the props.conf.spec below it has the configuration setting in your props.conf file: FIELD_NAMES = [ <string> ,..., <string> ] * Some CSV and structured files might have missing headers. This attribute tells Splunk to specify the header field names directly. My problem is I have been unable to get this to work. I push this into the props.conf file and when the logs are indexed I cannot find the field names. Example csv file looks like this: 1,2,3,4,5 6,7,8,9,10 The headers should be a,b,c,d,e, so what should I set FIELD_NAMES equal to? FIELD_NAMES = [a,b,c,d,e] or FIELD_NAMES = ["a","b","c","d","e"] or FIELD_NAMES = [ <a> , <b> , <c> , <d> , <e> ] or FIELD_NAMES = [ <"a"> , <"b"> , <"c"> , <"d"> , <"e"> ] or some other variation? I tried running btool check on my configurations but it doesn't reject what I have tried. ... View more