Assuming that you're wanting to exclude IPs that you're sourcing from a lookup against an index or other lookup, you could achieve this by doing: index=myindex sourcetype=mysourcetype src_ip=* NOT [|inputlookup mylookup.csv | stats count by src_ip | fields - count] | stats count by src_ip | fields - count If the IP field in your lookup differs from your indexed data, you can change via |eval Hope this helps. ... View more

Here's one way to do it: Create a lookup table that captures all the hosts you're wanting to alert on, should named be down OR data is not coming into Splunk. index="os" source="top" host=ns1 OR host=ns2 OR host=ns3 OR host=ns4 | stats count by host | fields - count | outputlookup named_hosts Make sure to cast the net wide enough to capture data from ALL of these hosts when making the lookup Next, create your search with an appendcols inputlookup to supplement potentially missing data with the "source of truth" lookuptable containing all the hosts you'd want to monitor, and filter for those hosts that aren't either 1) running named 2)sending data into Splunk: index="os" source="top" host=ns1 OR host=ns2 OR host=ns3 OR host=ns4 named earliest=-2min latest=-1min | appendcols [|inputlookup named_hosts] | fillnull | where count<1 You can get crafty to broaden your search for events coming from hosts and count those as "events_from_host" (without named filter), then search for "named_events_from_host" with named filter. So you'll catch each alerting instance independently. Hope this helps. ... View more

You'll first want to construct a search that returns results that you'd like to be alerted on: example (assuming you're indexing the data from your DB, and you'd like all fields present in your alert): index=my_db_index Duration_Hrs>24 | table * Then: Save As -> Alert There's a dozen or so fields you'll want to fill out within the "Save As Alert" box. I'd suggest reading the following : http://docs.splunk.com/Documentation/Splunk/latest/Alert/Definescheduledalerts . There are time windows and intervals you'll want to set to capture data in your required manner. ... View more

Well, if you were to install a UF on your windows nodes, it would make sense for the Splunk Indexers to archive the data after the indexed data reaches a certain size or age. - http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Automatearchiving ... View more

I'd keep your syslogs going to rsyslog, and have rsyslog write them to disk where a Universal Forwarder installed on said servers will monitor and send upstream to the indexing tier. example of writing to disk (rsyslog v3, old, I know): $template PerHostLogSys,"/var/log/remote/sys/%HOSTNAME%/%HOSTNAME%.%$YEAR%-%$MONTH%-%$DAY%.log" $template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogseverity-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n" & ~ :inputname, isequal, "imudp" ?PerHostLogSys;RemoteHostFileFormat Then using log rotate: /var/log/remote/*/*/*.log { daily nocreate compress rotate=1 maxage=1 } Hope this helps. ... View more

The Universal Forwarder is the way to go. It's free, easy to install and manage (with the Deployment Server - which is also free). You'll not only be able to collect the Win Event Logs, but other machine data from your windows endpoints using the UF - such as installed programs, listening sockets, performance metrics, registry modifications, etc. The UF will also buffer messages if a connection upstream to the indexing tier times out. ... View more

Can you telnet to the VM on TCP/8000 from the VM itself, and from a machine on the same subnet? ... View more

You'll want to install the Splunk Add-on for Amazon. Have you checked the docs? - http://docs.splunk.com/Documentation/AddOns/latest/AWS/ConfigureInputs 1) You'll need to grant permission from within AWS to the account the Splunk is using to connect into AWS with. 2) You'll need to configure CloudWatch inputs as referenced in the doc above. Hope this helps. ... View more

Put in props.conf , with sourcetype s3_access_combined [s3_access_combined] EXTRACT-elb,client,backend,request_processing_time,backend_processing_time,response_processing_time,elb_status_code,backend_status_code,received_bytes,sent_bytes,request,user_agent,ssl_cipher,ssl_protocol = ^[^ \n]* (?P[^ ]+)[^ \n]* (?P[^ ]+)[^ \n]* (?P[^ ]+)\s+(?P[^ ]+)[^ \n]* (?P\d+\.\d+)\s+(?P\d+\.\d+)\s+(?P[^ ]+)[^ \n]* (?P\d+)[^ \n]* (?P\d+)[^ \n]* (?P[^ ]+)[^ \n]* "(?P[^"]+)"\s+"(?P[^"]+)[^"\n]*"\s+(?P[^ ]+)\s+(?P.+) ... View more

Could you paste what's in the jbridge.log file? Also - what version of java are you running? ... View more

So if I'm understanding you correctly - you have data between 8am-6pm, but want to show a timechart from 00-24hr, where data that doesn't exist gets a null value as a "placeholder value". try: | timechart span=1h count | appendpipe [|stats count |addinfo | eval temp=info_min_time."##".info_max_time | makemv temp delim="##" | mvexpand temp | eval count=0 | eval _time=temp | table _time count] | timechart span=1h sum(count) as count | fillnull This will give those hours that have no data a 0 value. ... View more

I just tested a gzip'd .csv file, and got proper extraction with the following inputs stanza: [monitor:///tmp/*.gz] index = main sourcetype = csv the sourcetype as csv should do it. ... View more

Can you verify that you're receiving events from the two AD servers in question? If yes, is the data that's coming showing event codes? Can you try to search: host=ADServer1 OR host=ADServer2 OR host=ADServer3 4662 and see if the string matches? ... View more

The sourcetypes that you define in inputs.conf can be called out in stanzas in your props.conf, as you've mentioned above. ... View more

Take a look at : http://answers.splunk.com/answers/92257/can-single-forwarder-forward-data-to-two-different-indexers.html ... View more

Interesting. It sounds like perhaps you're running into a DNS resolve issue when connected to a network. Which could be your "nsswitch" config or equiv depending on what OS you're on. Can you connect to Splunk Web via 127.0.0.1 when you're connected to a network? If so - this would start to point a finger at name resolution. What does megaman.localdomain resolve to on and off the network? (if public IP please mask). ... View more

How are you connecting into Splunk Web, localhost / 127.0.0.1 ? or a name? ... View more

Can you share some of the data including the csv header? ... View more

try - | bucket _time span=1h | stats sum(eval(COUNT_SENT+COUNT_RECEIVED)) AS test by _time ... View more