I know there have been quite a few messages on this, but I am still confused. I am trying to configure my heavy forwarder to NOT send the following from a file that is is monitoring: [Fri Dec 02 13:10:22 EST 2011] [java.lang.String] DEBUG: <?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv That's just the beggining of the line, but I want to key in on the word "DEBUG" and throw out all events that start with that. I know I have to put something in the props.conf and the transforms.conf, but I do not know exactly what to put in there. Also, can you please explain what the symbols mean in the fields you are recommending? I see lots of posts with "/+s" and stuff like this, but I don't know what the heck they mean. -Noob ... View more

I want to create a serverclass.conf that decides to deploy an inputs.conf based upon whether certain applications are installed. I already have splunk configured to deploy inputs.conf, but I have only been able to get as granular as "linux" but not "linux with this application installed" If serverclass.conf does not have the ability to get granular like that, I was thinking that I could create one application that deploys a script that looks for application logs and then creates the inputs.conf file based upon that..... Any ideas? ... View more

Folks, while the documentation for things splunklike are usually very good, it is very poor when it comes to using the deployment server feature. What I am looking for is some help with setting up some serverclasses based upon what types of applications are installed on those servers, and I don't want to deploy applications I want to deploy configurations. So lets say I designate one server, deploymentserver as my, you guessed it, Deployment Server. I place in splunk_home$/etc/system/local a serverclass.conf. I put a congiguration that says for all deployment clients that have alfresco, please monitor /apps/alfresco/log/alfresco.log. Can someone provide a very simple, one dimensional example of the above for serverclass.conf? I understand there are many other nuances to it. Then, on my server that I want to deploy this configuration to, I indicate that I am an alfresco server. Can someone provide a very simple, one dimensional example of the above as well for my SPLUNK_HOME/etc/system/local/deploymentclient.conf file? How do I indicate in this file "I am an alfresco server"? I will have servers that have multiple applications on them be part of multiple serverclass indicators, and indicate each application in the deplomentclient.conf Hope someone can help here. Thanks!! ... View more