Thanks for your inputs. I didn't think about this solution. The point about restart Splunk process is the same with Deployment-Server. But it makes more sense now to me to leverage the Cluster Manager than the Deployment-Server used for UF. ... View more

Thanks for your inputs. Regarding peer failure it's why I wanted to have data replicated between two sites in the same location (meaning two different data center). But my assumption was like you mentioned, Splunk Archi is not done for that purpose. Regarding SH, I think I am good as even if I use different Indexer master per location, I should be able to only use a single SHC which has access to all indexers across all locations. ... View more

Thanks for your help. ... View more

Thanks for your quick answer. I have another question following your answer. My aim is to have a centralized component masking data for all my servers (+2000) so if I can avoid deploying the add-on on every single host is better and also not impacting the servers where the forwarders run. Do you think it's possible to install the add-on on a Heavy Forwarder and having the UF sending the data to this HF which will handle the data ? ... View more

Great ! $click.value2$ works! Thanks for your help @niketnilay ... View more

Actually not. I have others fields which would require the same. Is there not any other command that make the trick like mvexpand but for multiple fields? ... View more

So the XML file looks like that: <?xml version="1.0" standalone="yes" ?> <SymCLI_ML> <Symmetrix> <Symm_Info> <symid>0000000001</symid> </Symm_Info> <Device> <Dev_Info> <dev_name>00001</dev_name> <configuration>RDF1+TDEV</configuration> <rdfa_backed>True</rdfa_backed> </Dev_Info> </Device> <Device> <Dev_Info> <dev_name>00002</dev_name> <configuration>RDF1+TDEV</configuration> <rdfa_backed>True</rdfa_backed> </Dev_Info> <Device> </Symmetrix> </SymCLI_ML> The table like that: Row Number symid dev_name 1 0000000001 00001 00002 So I would like to have the value of the device when clicking on it, when I only use the default Cell drilldown it works fine, but when I want to give the value as a parameter to another dashboard using below command it gives both values: <drilldown target="_blank"> <link name="Device Name"> <![CDATA[/app/myapp/mydashboard?form.var_symid=$row.symid$&form.var_device=$row.dev_name$&earliest=0&latest=]]> </link> </drilldown> ... View more

/var/middleware/inventory/var/tomcat.out file position = 74 file size = 74 parent = /var/middleware/inventory/var/ percent = 100.00 type = finished reading /var/middleware/inventory/var/tomcat_jvm.out file position = 764 file size = 764 parent = /var/middleware/inventory/var/ percent = 100.00 type = open file What's the difference between "open file" and "finished reading" ? Really strange behaviour today, only the file that was not read before has been read today. ... View more

That's the output: /var/middleware/inventory/var/tomcat_jvm.out file position = 764 file size = 764 parent = /var/middleware/inventory/var/ percent = 100.00 type = open file ... View more

It helps thanks! I will let the forwarder running for few days and monitor if the file will be read or not and use the command to get info. I will come back with comments. ... View more

Ok so I upgraded the forwarder to version 6.4.3 and run the command ./splunk list inputstatus The output contains the file which is not read and there is still no error in the logs. I did test to renamed the file to tomcat_jvm2.out and Splunk is picking it up... Any other suggestion? Thanks! ... View more

Got it, UF version is 6.2.7. The servers are on 6.4.3. It explains, if I could have it upgraded soon I will have a try but anyway I also already tried with crcSalt = . ... View more

Are you sure this command can be run on the UF ? I got the below error message when running it (but I am able to do it on the Splunk Servers): ./splunk list inputstatus Command error: The subcommand 'inputstatus' is not valid for command 'list'. Data forwarding configuration management tools. Commands: enable local-index [-parameter ] ... disable local-index [-parameter ] ... display local-index add [forward-server|search-server] server remove [forward-server|search-server] server list [forward-server|search-server] Objects: forward-server a Splunk forwarder to forward data to be indexed search-server a Splunk server to forward searches local-index a local search index on the Splunk server Searching for index=_internal source=*splunkd.log tailreader ERROR there is no log for the host where I am trying to get the file to be read. Thanks ... View more

As per my inital question, I already tried that and everything here: http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Extractfieldsfromfileswithstructureddata ... View more

Just tried adding that to my current props.conf but now it index the entire csv as one event (including the header). props.conf is defined at the indexers level (master-node), not at the forwarder level but I don't think it changes anything. ... View more

I also tested your solution, works fine as well. Thanks! ... View more