If your data actually includes the double quotes character (") then that should work. If the data does not, then it won't. REGEX=\"FIP VLAN\" will match "FIP VLAN". Note the quotes actually exist in your data, and there is a single invisible space between the words. REGEX=FIP VLAN will match FIP VLAN. Note there are no quotes in the data, and there is a single space between the words. REGEX=\"FIP\sVLAN\" will match "FIP VLAN". Note there is a single space between the words. The "\s" char requires exactly one whitespace between the words, which can be a space, tab, or linebreak. This is better if you're certain there is only one space, for example you don't want to filter out "FIP VLAN" (two spaces between). REGEX=\"FIP\s+VLAN\" will match "FIP VLAN". Note there is a single space between the words. The "\s+" char requires one or more spaces between the words. This is better if you're not certain how many spaces there could be. REGEX=\s+FIP\s+VLAN\s+ This will filter out (space)FIP(space)VLAN(space). This is better if you want to be sure NOT to filter out phrases like: FIP VLAN2, or TFIP VLAN There are lots of easy regex testers online, and free tools to download. ... View more

Some commands require auth, and some don't. Those that do may let you use a Splunk non-admin account, which might be a good way to setup a global login that has no capabilities on the Splunk server, but let's you query the Forwarders. "splunk display app" doesn't require authorization as far as I can tell on my system. Perhaps it's different when running remotely. FYI: The Deployment Server does not authenticate to the Forwarders. The Forwarders connect to the Deployment Server to request updates. ... View more

The Splunk Distributed Deployment Manual has all the details on this, but if you're using a server-class system you may not need additional servers until you exceed 100-200GB/day. The simplest sizing guide in the Manual is this page, and I recommend reading the whole "Estimate hardware requirements" subject starting here. Yes, you can use your existing Splunk server as a Search Head or Search Peer if you expand to a distributed environment. The first step that most people take is adding a second indexer to their environment. You would keep your existing Splunk server as it is, and add another server setup as an indexer only, configure the original server to search both it's local data and the new server's data, and configure any Splunk Forwarders to auto load balance and send data to both indexers. This would basically double the amount of data you can index daily, and increase your search performance. ... View more

Hi Stefan: A cluster is a distributed deployment, just with the index replication enabled and a Master Node to manage it. If you are only interested in performance just do a distributed deployment. Yes, you can run your search head on an indexer. Many of our customers when they are scaling from a single Splunk server to more servers their first step is to add a second server as an indexer, so their total configuration would be one server acting as a search head and indexer, and a second server acting as only an indexer. The performance penalty for running a search head on an indexer depends on how much searching you're doing, the types of searches, and over how much data. Basically you'll require one CPU core on every server that your search is running on for the duration of the search. If your search head is running on an indexer I believe that you'll be using two cores for each active search. This means that if you're running four total servers, and one of the servers is hosting the search head as well as an indexer, that server is likely to be resource constrained in both CPU and Memory. There are some descriptions and example calculations in this Splunk Doc page: Accommodate concurrent users and searches Since it's not easy to calculate your search and indexing load manually, I suggest you download and use the Splunk on Splunk App on your existing Splunk server. It will show you all kinds of useful search and indexing performance statistics, and as you add more Splunk servers to your environment you can see how your performance changes, and decide as you scale up whether you're happy with the performance of a search head on one of your indexers, or running it separately. If it were me, and I had access to four servers, I'd probably deploy two servers as indexers and one server as a search head and indexer. Then I'd monitor it for awhile and see how the performance was and the resource contention on the server running the search head. If performance was poor and resource contention was high on the search head box, I'd deploy the forth server as a search head and switch the combined server to an indexer only. If I was having no problems with the combined server, I'd add the fourth server as an indexer. Best of luck! Jon ... View more

What you're trying to do is restrict your results in your SQL query. It should look like this: | dbquery "MYDB" "SELECT text_field FROM my_table WHERE text_field LIKE '%Description%' " The "LIKE" command searches for any string that contains the string you feed it. The "%" character is a wildcard, so %description% will match any text field that contains the string 'description'. Also be sure to verify the correct use of SQL quotes within your Splunk search. Here's a simple manual page on the subject: http://www.techonthenet.com/sql/like.php ... View more

It would be fairly simple. Assign a cost per minute for each resource, then create a "lookup" that contains the resource name and the cost per minute of downtime. Next you will create a search for each resource that detects minutes of downtime, run the "lookup" to match the resource to the cost, multiply the cost by the length of time of the outage and graph it. This is very similar to what many customers do for their management console. Here is the documentation for lookups: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usefieldlookupstoaddinformationtoyourevents Here is a tutorial on how to use lookups: http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Usefieldlookups Good luck! ... View more

Hi Felipe: Index replication works by copying any new cold buckets from the originating indexer to additional indexers. The receiving indexer will not show the data unless the originating indexer is down. This is all controlled by the master node. It keeps a list of all primary index buckets, and which indexer is primary for each bucket, and therefore will search which buckets. This is the starting point in the docs to see exactly how this works. Start here and read through all the linked topics: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Basicconcepts Best, Jon ... View more