If you want to disable to learned app see this post: https://answers.splunk.com/answers/77271/make-splunk-stop-learning-sourcetypes.html Here is the relevant part of the post: If you really would like to disable learning, edit $SPLUNK_HOME/etc/apps/learned/local/app.conf and make sure it says this: [install] state = disabled ... View more

While that is true, I saw this on the Splunk Data-Onboarding Checklist http://blogs.splunk.com/wp-content/uploads/2010/03/SplunkOnBoardingChecklist.pdf ... View more

While I don't know your deployment topology (distributed deployment or not, or even if you have multiple deployment servers)... If you have multiple deployment servers, there is a so-called Multi-tenant scenario "Example: How to propagate apps from Primary to Secondary Deployment Server" http://wiki.splunk.com/Deploy:DeploymentServer (which will be unsupported in the next major release of Splunk 7.0). More details straight from the docs: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Tenantsconf. There is another Answers post on this method: http://answers.splunk.com/answers/60559/can-one-deployment-server-send-data-to-another-deployemnt-server.html If you version control your apps in say Git (or some other version control system), you can check in your config apps which live on say on DS1 (deployment server one for DEV/UAT), then you can pull down your config apps on DS2 (deployment server two for ITA, etc.), then reload the deployment server. In a distributed deployment, which most large enterprise environments have due to having data collected from multiple data centers, method 2 might be your best bet! Good luck! ... View more

This is awesome. This should be built-in! ... View more

Correction: I saw the error re-appear, so the exact root cause it unknown! ... View more

It turns out that this particular search head was on a different VLAN than all my other ad-hoc search heads and search head pool members. Furthermore, there was a network issue (router issues) between the search head in question and the target indexers. When the network connectivity was restored, I re-entered the password for the search peers (indexers) and then everything was fine. ... View more

see http://wiki.splunk.com/Community:CallbackRunnerThreadTooLong ... View more

see http://wiki.splunk.com/Community:CallbackRunnerThreadTooLong ... View more

See http://wiki.splunk.com/Community:CallbackRunnerThreadTooLong ... View more

Similar scenario with logrotate compressing and rotating logs see http://answers.splunk.com/answers/121267/how-does-splunk-handle-nix-logrotate-based-log-rotation ... View more

I have observed same when in no particular order 1) hostname -f fails to return an FQDN 2) in /etc/hosts if the line containing the hostname / hostname w/ FQDN is of the format IP SHORTNAME FQDN when in point of fact it must be of the form IP FQDN SHORTNAME That's why hostname -f didn't work. Wrong ordering suppose we have an /etc/hosts as follows 127.0.0.1 localhost localhost.localdomain a.b.c.d hostname hostname.domain we can resolve as follows: grep localhost /etc/hosts > /etc/hosts.correct grep `hostname` /etc/hosts | awk '{print $1 " " $3 " " $2}' >> /etc/hosts.correct \cp -p /etc/hosts /etc/hosts.broken \cp -p /etc/hosts.correct /etc/hosts Output of /etc/hosts 127.0.0.1 localhost localhost.localdomain a.b.c.d hostname.domain hostname ... View more

I am using 6.0.2.2 I tried this workaround on an ad-hoc search head with multiple indexers and it worked for me. I have not tried this on a search head pool, yet. ... View more

Consider using the RFC5424 Syslog technical add-on http://apps.splunk.com/app/978/. Sounds like exactly what you are looking for 🙂 caveats from documentation are listed below as of v1.0 of the said app: KNOWN ISSUES/LIMITATIONS - Fields which appear more than once in an event (i.e., field1="value1" field1="value2") will not be evaluated as multi-value fields - Within a structured data block, the SDID is not associated with the local field names; it is simply another multi-value field, "sdid" - The MSG section of the event, if it exists, is not parsed by this app. ... View more