Hi All, We have a requirement where we are supposed to capture error from the logs using Splunk running on Windows 10 machine which will trigger a script to send the details to Netcool using snmp protocol version 3 from Windows 10 so that they can create tickets. I refer to below link: http://docs.splunk.com/Documentation/Splunk/6.3.12/Alert/SendingSNMPtrapstoothersystems http://wiki.splunk.com/Community:Splunk_Alert_MIB http://wiki.splunk.com/Community:Sending_SNMP_Traps_On_Windows but was not able to get it worked. Also the script is using SNMP v2. Also i was not able to installed NET-SNMP on Windows 10. Is there any exe file for 64 bit. Can anyone please help me to resolve this issues? ... View more

i am creating various reports which are schedule on cron expression but i wanted to see if there is any possibilites to trigger the searches if the previous search is ran successfully. I am running various searches which create a csv as output and my last search runs a python scripts which combines all the csv into excel. ... View more

Hi, I need to open the firewall for communication between Iron stream and Splunk. As per the requirement, I am aware that Ironstream will be sending the logs to Splunk via TCP/IP protocol to port. But as per the requirement, i need the Application Protocol which Splunk will use for ingesting the logs on the port. Can someone help me? ... View more

Hi, Is there any way where we can identify how much data the forwarder is sending and how much data is being indexed in real-time? The problem is that I have a single forwarder that is sending data to a single indexer and its sending multiple logs i.e. 50 monitored files with different indexes. I am receiving data from a few indexes in real time whereas for some indexes I am having a lag, so I want to remove the lag and if possible give higher preferences to some logs file. ... View more

Can someone help me in resolving the issue? Splunkd Universal Forwarder is taking 100% process. I am monitoring around 50 logs files and the data is not more than 30GB daily. For monitoring i am not having any wild characters and have given full path of log files. ... View more

I am facing issues while searching any logs and its takes a lot of time to index the log. While investigating, i am seeing many times the queues are blocked as mentioned below. INFO Metrics - group=queue, name=indexqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=1466, largest_size=1466, smallest_size=0 Is it worth to increase the max size of the queues? Also while config file i need to change to increase the same? ... View more

I have created an alert which checks if logs are not present in last 20 mins per source. I have around 32 source files from single forwarder. Many of my files are not getting indexed in real time and I am receiving this alert frequently. Can anyone tell me any parameters which needs to be changed so that I can index the data in real time? is there any mechanism to check what is the inflow rate of the data? System Info: I also see my CPU is around 80% idle and working Windows OS. I have 4 Core machine 32gb ram Splunk Enterprise 6.4.3 ... View more

I have one instance which run as Search Head and other instance as Indexer. I wanted to know where should i setup Monitoring Console so that i can monitor the performance of search peers? If i try to setup distributed mode on my search head, its give me warning "Do not configure the DMC in distributed mode if this is a production search head. Doing so can change the behavior of all searches on this instance. This is dangerous and unsupported. If you want to configure the DMC in distributed mode, you must locate the DMC on an instance that is not a production search head." ... View more

Hi, I need to create report in format. Could anyone help me in achieving this. I can have time interval of 2 hours as well if cannot have in the format. ... View more