Could you make use of the outputlookup or outputcsv command in your dashboard? http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Outputlookup http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Outputcsv Cheers, Greg. ... View more

Hi again, I think you might benefit from reading through some of our documentation on forwarding data. You should only have one instance of Splunk Light and then one or more Universal Forwarders running on one or more remote machines where the log files are to be monitored. http://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Forwarderdeploymenttopologies In the diagram in the link above your Splunk Light instance is labelled the Indexer. You should also read this section of our documentation: http://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/HowtoforwarddatatoSplunkLight You can forward log data from Windows or Linux systems using the Universal Forwarder and your Splunk Light instance can run on either Linux or Windows. I hope this helps. Cheers, Greg. ... View more

One key question here is how long do you want to keep the data for? Other questions worthy of consideration are: are you planning to use data models and/or summary indexes? Note that some apps on splunkbase may use data models or summary indexes. are you running a cluster and planning to use index replication? The splunk-sizing web app will help you get most of the way there and allows you to specify storage contingency. Cheers, Greg. ... View more

Have you tried the REPEAT_MATCH = true attribute in your transforms.conf stanza? Cheers, Greg. ... View more

Hi, Yes you can install the Universal Forwarder on the same machine as the Splunk Light instance though there wouldn't necessarily be any reason to do so since you can have the Splunk Light instance monitor local log files or receive syslog (or other network inputs) input directly. However, the OPs suggests that the log files are on remote machines so in this case you'd want the Universal Forwarder on those remote machines. Cheers, Greg. ... View more

Thanks for picking this up Chris; I'd added the link in the editor and it previewed just fine; don't know why it didn't show up in the final submission:( Lesson learned today - always check the final submission! ... View more

Hi, The Universal Forwarder is installed on the remote machines where the logs are. You configure the Universal Forwarders to monitor the log files from which you want to collect events and then to send these events to your Splunk Light instance. Check out the documentation on how to do this for Splunk Light. ... View more

Ok. I meant to mention this earlier but try anchoring the TIME_PREFIX. I.e. TIME_PREFIX = ^(.){14} Cheers, Greg. ... View more

I would try setting: TIME_PREFIX = (.){14} MAX_TIMESTAMP_LOOKAHEAD = 21 Given that the timestamp begins on the 15th character so there would only be 14 characters prefix and I think you ought to lookahead to at least the character position marking the end of the timestamp. Cheers, Greg. ... View more

Thanks, you've confirmed what I thought. And there's no difference in behaviour between v1 and v2 in this regard? ... View more