Hi, I'm trying to configure performance monitoring inputs on a Windows universal forwarder, to send to a Linux indexer, by modifying inputs.conf as per: http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Real-timeWindowsperformancemonitoring#Configure_local_Windows_performance_monitoring_with_configuration_files So far, I've only managed to find a few valid performance objects for the [perfmon://] stanzas by searching in Splunk Answers. Does anyone know if there's a list of valid performance objects we can use in [perfmon://] stanzas in inputs.conf? Thanks! ... View more

Hello, In indexes.conf, we can specify a value for coldToFrozenScript, to run a specific script when cold buckets are rolled to frozen. What happens if the script fails to execute, or returns an error code, etc, when a rolling of cold buckets to frozen is triggered? Will the cold buckets be deleted in this case? Thanks! ... View more

Hi, I understand that there's a limit of 3 columns in a dashboard, using Advanced XML (though I've read some threads here that say 4 or more columns are possible). Is there a hard limit on the maximum number of dashboard panels allowed in a dashboard? Thanks! ... View more

Hello, Splunk's dashboard panels, as well as single values within the panels, have a rounded rectangle shape. Is it possible to change the dashboard panel's, and/or the single value's shape, to a circle, for example, through a combination of Advanced XML and modifying application.css? Thanks in advance. ... View more

Hello, On my forwarder, at $SPLUNK_HOME/etc/system/local/inputs.conf, I have a monitor configured: [monitor://C:\Program Files (x86)\Application\Application Logs\Logs] disabled = 0 whitelist = (log$) I can see from my indexer that the log files I expect to be indexed are there. I want to adjust the sourcetype for that particular source, so I configured $SPLUNK_HOME/etc/system/local/props.conf as follows: [source::C:\\Program Files (x86)\\Application\\Application Logs\\Logs\\*.log] sourcetype = custom_sourcetype However, that stanza does not seem to work. After playing around, I managed to find the following stanza below which works: [source::...\\Logs\\*.log] sourcetype = custom_sourcetype Could someone please tell me why? Do spaces, or parentheses in the source file name need to be escaped somehow? Thanks! ... View more

Hello, Does anyone have any experience using Vblock with Splunk? Vblock: http://www.vce.com/vblock/ I'm mainly interested in whether the Vblock has centralized logs, and whether we can install a forwarder on it. Thanks! ... View more

Hello, Assuming that I have a universal forwarder configured to monitor a directory of flat files, e.g. /var/log/, what happens if the following sequence of events happens? Universal forwarder is monitoring files in /var/log Universal forwarder crashes for some reason, or someone accidentally kills the process Files in /var/log are modified, written to, etc. Assume a large number of changes have been made Universal forwarder is restarted In this situation, will the universal forwarder simply check through /var/log for any modified files, and send all the changes in the logs to the indexer at one go, thus possibly saturating the network bandwidth? I believe the universal forwarder's max throughput is 256 kb/s, so if there's a large amount of changes, will it always attempt to send data to the indexer at this maximum rate? Is there any way to throttle the universal forwarder's sending rate? ... View more