Well like a said before when you summary index data it is new data that has been indexed so it will have a new host, source & sourcetype assigned automatically. You can either just use a different field instead of sourcetype from your events, or put a new value into the existing sourcetype field using an | eval statement assignment. ... View more

So yes summary indexing will create a new host, source and sourcetype field for that data that has essentially been newly indexed into the summary index you just created. You can either just use different field names for the host, source and sourcetype fields (i.e. orig_) or remap them using the option under the Summary Indexing in the UI. I've always found the best way to validate and test a new index is to use the | collect command to ensure everything looks OK before setting up the job. The Summary Indexing option in the UI really just uses that | collect command anyway. Check out the docs for more info: http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usesummaryindexing ... View more

In versions of Splunk lower than 7.0 the same function can be achieved with the summary indexing option (located towards the bottom of the page, below Alert actions) this will send the events from your search into a new summary index. Optionally you could also you the | collect command and achieve the same result. Just be sure when you are storing data into a summary index it matches the format that you expect 🙂 ... View more

Perhaps you could you use a subsearch to find the data you are interested in | fields x and then pass those to the outer search? ... View more

Do you mean you want to log new events into a summary index or you want to track that the report completed it's schedule? ... View more

You could always put a | head 8 command in the mix to restrict it to the first 8 results of the lookup file. ... View more

SummaryDirector processes are around the maintenance activities that Splunk runs in the background around search cache and summarization needed to ensure buckets and search are processed. Most of this is defined in the limits.conf.spec file for more background. There is another good answers post on some of this here as well: https://answers.splunk.com/answers/123443/indexers-with-large-number-of-indexes-becoming-unresponsive-because-of-acceleration.html ... View more

Are there any errors in the log & can you send email from that search head alone? Try sending an email via telnet (https://mediatemple.net/community/products/dv/204404584/sending-or-viewing-emails-using-telnet) and see if you get an error. It might be ACL related or with the mail relay. ... View more

the only way to make them clear out automatically outside a cron or other script would be to set the TTL on the jobs in the savedsearches.conf to a lower value (in seconds). The jobs are treated individually in this case & not as a group. there is a good write up here on the ttl https://answers.splunk.com/answers/149394/is-there-a-way-to-set-the-job-ttl-to-a-different-value-for-a-saved-search.html ... View more

a restart of the forwarder will force a check. Just make sure your deploymentclient.conf is set correctly. ... View more

I believe the add-ons come as part of the package - check the /opt/splunk/etc/apps directory and see what's in there? ... View more

if you are using FQDN and the hostnames are logical per domain you can do something with the SOURCE_KEY? SOURCE_KEY = metadata:host REGEX = <something> DEST_KEY = <something> FORMAT = <something> ... View more

kind of...you basically have millions of events with the same date/time stamp which is causing an logical error in Splunk as to how many events it can process per second. (see http://splunk-base.splunk.com/answers/2958/error-in-indexscopedsearch-the-search-failed for very good explanation) This is usually related to a bad time date stamp logic in a props.conf somewhere that isn't breaking the events down correctly. ... View more

A Splunk setup can be distributed so that your search heads (the GUI that you run your searches through) and the indexers (what crunches the data) can be separated out. It can also be an all-in-one solution that does both. The Splunk App for NetApp ONTAP has 2 main components: It has a search head app. This is the GUI side and has the dashboards you use to view the data. This get's downloaded from http://splunk-base.splunk.com/apps/67764/splunk-app-for-netapp-ontap and can be installed through the manager/app section on the search head Splunk_TA_ONTAP7 is what is called a Technology Addon - it supplies the indexing logic needed to make the data collected (in this case from the NetApp) searchable and useful for the dashboards. It has the props.conf and transforms.conf that are needed to manipulate the data. In a distributed environment this would sit at the indexer, but in an all-in-one solution it can be installed within the apps directory as well. You need both of these to make the application work correctly. ... View more

I think you may be able to use a summary index for this instead of all these lookups? You could have multiple searches feed the available data into a larger index and then customize your report to run off that data with the fields you need already set. ... View more

It's actually done with both the props.conf and the transforms.conf basically you have a props.conf kinda like this: [source::F:\\Logs\\Company_Name\\Productfile.txt] TRANSFORMS-setSourceType=setCompanySourceType then a transforms.conf like this: [setCompanySourceType] SOURCE_KEY = MetaData:Source REGEX = F:\\Logs\\(\w+_\w+)\\ FORMAT = sourcetype::$1 DEST_KEY = MetaData:Sourcetype Now you can switch this around for whatever combination you need but basically you are assigning metaData thru regex. ... View more

if you create a user with that method it will be a local user by default. Your ldap users will be auto-populated from your ldap directory based on your group mappings. ... View more

You'll need to create a new user it's under Access Controls - Users - Add New ... View more

You can't specify an ldap account to be local, you can however create a new local user on a system that has ldap already set. ... View more

The "i" is actually the slave_name field that I don't believe exists in the _internal index. It can be found manually if you go the indexer and look under Manager - Licensing for "slave_name". You could make a lookup table from that info if you want to use it for reporting. ... View more

root ownership is not necessary but installation as root is. You can change the ownership after the fact if necessary: http://splunk-base.splunk.com//answers/82021/unable-to-start-splunkweb ... View more

try downloading the .tgz file from the site and extracting in the /opt directory as root. ... View more

I've found the easiest away around this to reformat the stdout of the info to create an "event" with strict field assignments and a time data stamp so that when Splunk reads it it will be indexed by the time format I set in the props.conf. ... View more

while not strictly necessary you may want to add followTail = 1 to your inputs.conf to ignore the older data which may be causing the issue. from the doc: followTail =1 Can be used to force splunk to skip past all current data for a given stanza. * In more detail: this is intended to mean that if you start up splunk with a stanza configured this way, all data in the file at the time it is first encountered will not be read. Only data arriving after that first encounter time will be read. * This can be used to "skip over" data from old log files, or old portions of log files, to get started on current data right away ... View more

could you provide the details of how the input is configured? ... View more