Hi im working on developing a large advanced-xml dashboard. It appears splunk in some stanza's is ignoring some params. For example .... .... <module name="HiddenSearch"> <module name="TimeRangePicker"> <param name="default">Last 24 hours</param> <param name="searchWhenChanged">True</param> <module name="HiddenSearch" autoRun="False"> ... <module name="SubmitButton"> ... <module name="Message" layoutPanel="graphArea"> ... <module name="JobStatus"> ... <module name="FlashTimeline" layoutPanel="graphArea"> ... ... Results in the gui time range picker still defaulting to "all time" even though it is set to 24 hours. Is there anyway to force it a particular time range, as the doc says is possible? We are running 4.1.6, and I am editing the files from the manager. I can post the entire dash if it would help anyone (300+ lines) Cheers ... View more

Hi we have a rather complicated setup, part of which uses an intermediate forwarder (full wf) to pass events from a series of light weight forwarders to a central index. We would like to conduct all our transformations and data processing on the indexer, with the intermediate forwarder acting as nothing more than just a relay point for the light weight forwarders which point to it. The problems I've been facing are rather strange. originally I noticed that splunk was not doing any transformations, field extractions or time stamping on the data that was coming through the intermediate forwarder. I am assuming that as it passes through the forwarder the data get's "cooked" so when it arrives at the indexer, the indexer assumes it does not need to do anything other than add it to the index. So I changed the outputs.conf on the intermediate forwarder to send raw data. [tcpout] defaultGroup = blahblah disabled = false [tcpout:blahblah] server = indexer:9996 sendCookedData = false Hoping it would spur the indexer into doing the data processing. However this just lead to splunkd crashing on the intermediate forwarder every time it tried to connect to the indexer after it spewed these messages below a few hundred times (crash report here). Taken from the intermediate forwarder, 01-31-2011 01:52:59.846 WARN TcpOutputProc - TcpSendThread: Connection to server 10.137.7.20:9996, fd:23 lost - retrying: Broken pipe 01-31-2011 01:52:59.846 INFO TcpOutputProc - attempting to connect to indexer:9996... Taken from the indexer <Monday Januar<90>^Yó^C! from hostname=intermediateforwarder, ip=XXXXXXXXXX, port=34447 01-31-2011 08:47:51.676 INFO TcpInputProc - Hostname=intermediateforwarder closed connection 01-31-2011 08:47:52.444 ERROR TcpInputProc - Received unrecognized signature This lead me to reverting back to sending cooked data, which worked, (ie splunk did not crash and the data makes it through, but unanalysed), current outputs.conf on the intermediate forwarder. [tcpout] defaultGroup = blahblah disabled = false [tcpout:blahblah] server = indexer:9996 Then I went down the route of trying to force the indexer to reanaylze the data, by adding route=... to inputs .conf as below. [default] host = indexer [splunktcp://9996] route=has_key:_utf8:parsingQueue;has_key:_linebreaker:parsingQueue;absent_key:_utf8:parsingQueue;absent_key:_linebreaker:parsingQueue; This nearly works, all the data now gets transformed and has its fields extracted but, about 40% of the data is not being correctly timestamped (ie exactly X hours in the future). Its strange because the date format is exactly the same, same sourcetypes, and even the same sources of data are appearing to be correctly indexed and indexed in the future at random. I tried disabling all timestamp extraction on the indexer and just logging the events as they came in, however this still resulted in "future events". As such I am completely out of ideas on what my next move should be. I know the obvious solution would be to do all the transforms on the intermediate forwarder, but this is something we would like to avoid doing. If you have ideas any I'd be glad to hear them. Thanks ps our enviroment is a mix of solaris and linux (red hat), all splunk instances are 4.1.6. ... View more

Hi, I would to know if it is possible to use a part of the source events file path ie "foobar" from /weblogs/123/https-blah.com/foobar and extract it as a field or value (ie ws_server) in either a search or via transforms.conf / props. Thanks ... View more

Hi I am fairly new to this sort of thing, I am trying to build a view that has 3 Dropdown menus that populate themselves from the selections made in the previous drop downs. For example The first dropdown lists "domains" (which would ideally be prepopulated from a file), the second drop down then lists all the clusters in the selected domain, and then the third drop down shows all the servers in the cluster selected in the second drop down. The selected server in the third drop down then populates a eventViewer below with recent events. Is this possible to do this in simpleXML? or would advancedXML be better? My current code is below, it doesnt really do much as I cant figure out how to link up the drop downs to create a master search 🙂 <form> <label>Server Selecter Test</label> <searchTemplate>$domain$</searchTemplate> <fieldset> <input type="dropdown" token="domain"> <label>wl_domain</label> <populatingSearch fieldForValue="wl_domain" fieldForLabel="wl_domain" earliest="-2h"><![CDATA[host="*" | top wl_server limit=10]]></populatingSearch> <default>*</default> <choice value="*">Any</choice> </input> </fieldset> <label>Search Form Test</label> <searchTemplate>$cluster$</searchTemplate> <fieldset> <input type="dropdown" token="cluster"> <label>wl_cluster</label> <populatingSearch fieldForValue="wl_cluster" fieldForLabel="wl_cluster" earliest="-1h"> <![CDATA[host="*" | top wl_cluster limit=10]]></populatingSearch> <default>*</default> <choice value="*">Any</choice> </input> </fieldset> <label>Search Form Test</label> <searchTemplate>$server$</searchTemplate> <fieldset> <input type="dropdown" token="server"> <label>wl_server</label> <populatingSearch fieldForValue="wl_server" fieldForLabel="wl_server" earliest="-1h"> <![CDATA[host="*" | top wl_server limit=10]]></populatingSearch> <default>*</default> <choice value="*">Any</choice> </input> </fieldset> <row> <table> <title>Selected Event Info</title> <option name="blah">true</option> </table> </row> </form> ... View more

Hi, We are working on planning for a large splunk deployment, I would like to know if it is all possible to set up a deployment server, which pushes out configurations / apps to another deployment server, which in turn pushes these out to lightfowarders & indexers on the other side of a firewall (from the original deployment server). Also is it possible for an instance to be both a light forwarder and a deployment server? Cheers ... View more

Hi there, My Splunk environment is made up from 1 Deployment Server, 1 Indexer and 20+ light forwarders. How could I go about setting up a single inputs.conf which is pushed from the deployment server to the forwarders. Each of the forwarders has a unique set of logs in various locations. I do not want to manage a single log file for each forwarder, but would rather have a single conf file which lists all the locations for various machines, with each machine only looking at the portion in the conf list which is relevant to itself (ie locations blocked via hostname) Ideally I would have a file like this inputs.conf srv1 monitor://blah ... monitor://basddsfd ... monitor://dfsdf ... srv2 monitor://gdfg .... etc is this possible? Cheers ... View more

Hi, I am having difficulty setting up a deployment server which serves 2x light fowarders. I beleive I have set up the conf files correctly? deploymentclients.conf (on the fowarders) [deployment-client] disabled = false [target-broker:deploymentServer] targetUri = myServerName:8089 serverclass.conf (on the deployment server) [serverClass:global] whitelist.0=* [serverClass:lightforwarders] whitelist.0=* [serverClass:lightforwarders:app:SplunkLightForwarder] stateOnClient=enabled restartSplunkd=true Is there anything else I need to do to make the server a deployment server (I couldnt find any directions, so I assumed all I need is the serverclass.conf). The same goes for the deployment clients, are there any settings or commands that need to be run to make them clients? When I run ./splunk list deployment-clients, it says no clients have contacted the server. If anyone could write some instructions, that would be much appreciated. Cheers ... View more