Thank you for this 🙂 ... View more

If my enterprise AD admins will not allow Splunk Agent on DCs, is DNS Debug logging and Windows Event Forwarding my only option?  Do you have any reference/suggestions regarding this configuration?  Additionally, and read on the article, it seems Stream is the preferred implementation and not DNS Debug. Can you elaborate as to why? Thank you much in advance. ... View more

To manually merge buckets from multiple legacy indexers onto one new indexer, I used these commands which work on RHEL7/8: 1. on the legacy indexers, in indexes.conf, set maxVolumeDataSizeMB=400 for the warm volume to force all buckets to roll to cold 2. on the legacy indexers, in /etc/sudoers add johndoe ALL=NOPASSWD:/usr/bin/rsync to enable passwordless sudo with rsync 3. on the new indexer, run this command to rysnc cold buckets from each legacy indexer to a subfolder on the new indexer: sudo rsync --delete --compress-level=0 -aPe ssh --rsync-path="sudo rsync" johndoe@192.168.1.108:/splunk_cold /splunk_cold/idx8 in the above case, 192.168.1.108 is the address for legacy indexer#8 4. on the new indexer, run this command to renumber the buckets from each indexer for i in /splunk_cold/idx8/*/colddb ; do echo $i ; cd $i ; ls ; for f in ` ls -rtd db_* `; do jj=` echo $f | cut -d "_" -f 4 `; kk=$(($jj + 8000)) ; ff=` echo $f | sed -e "s/_$jj\$/_$kk/" ` ; mv $f $ff ; done ; done in the above case, each bucket from indexer#8 with 3-digit id=xxx is changed to id=8xxx 5.  on the new indexer, run this command to merge each subfolder to the parent folder cd /splunk_cold/idx8 ; 596 find -type d -exec mkdir -vp "/splunk_cold"/{} \; -or -exec mv -nv {} "/splunk_cold"/{} \;   ... View more

Part of my snippet folder now! really helpful. thanks ... View more

@gnazer Are you getting SEP data into Splunk at all? Does "index=* sourcetype=sep*" return "SEP-related" data? If not, you have any problem not addressed by this answers post, then open a new answers post. If you are getting data, but believe it could be unrelated to a flaw in this answers post, then open a new answers post. If you are getting data, and believe the issue might be one of the flaws addressed by this answers post, then please let us know more. ... View more

Btw this was exactly the fix I needed, in my case. Not sure if anyone else has mentioned this, but I found that with it configured as shipped, I not only "saw no results" in the app but futhermore it would peg the frak out of my server while it searched (in vain). Simply loading the BC App has pummel the thing to a 60 load average (yes - SIXTY). Good thing I wasnt running it on Windows or it would've burst into flames. But not that it works you've made me a Supa Stah (thanks!!) 😛 ... View more

I added a bit at the end - essentially it's going to boil down to the level of comfort your exchange admin (maybe you?) have in making these changes. Historically I would say the path of least resistance is making the change at the reporting level (i.e. Splunk). (also the saving you'd make in terms of licensed usage from making the change on the Exchange server would be negligible) ... View more

I'm having the same problem between my deployment server and index cluster. If I remove all the files and directories starting with my deployment server's name from $SPLUNK_HOME/var/run/searchpeers it recovers with no need to restart, Splunk 7.0.3 (build fa31da744b51). ... View more

similar thread here http://splunk-base.splunk.com/answers/70072/summary-indexing-blocked-and-binary-file-warning fix will be in 5.0.3 ... View more

You can find the geographic look-up of the ipaddress using the site http://www.ip-details.com/ . It gives the ip address, its location details such as country, region/state,city,ISP(Internet Service provider) details etc. ... View more

I just posted this for a low overhead way of doing what I hope I understood you are trying to accomplish. http://splunk-base.splunk.com/answers/48731/determining-logging-lag-and-device-feed-monitoring ... View more

See the answer to your question that you just asked. ... View more

thanks! that did it. conveniently, it turns out you can store the whole transaction in the summary index without even having to try and squish all of the desired fields onto one line. eventtype=cisco_esa [search | fields mid] | transaction fields=mid mvlist=t | collect index=summary creates the index, and running a search on "index=summary" actually returns the whole transaction for all of the search matches. unfortunately it seems like the field extractions are lost in the process. i need to see about getting those rerun on the index somehow. but at least all of the data is there ... View more

In 4.3.3 and going forward, there is a parameter (check-index) that you can set to make this to happen without getting an error message complaining about the nonexistent index. By setting check-index to false, Universal Forwarder would not require the index to be there to begin with, but this is not the default behavior in 4.3.3. For example: ./splunk add monitor /var/log/case1 -index test_case1 -check-index false The default behavior is different depending on the version 4.3.3 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.4 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.5 universal forwarder: default check-index is true, which means that it would always check whether the index exists 5.0.2 universal forwarder: default check-index is false ... View more

As per Sean's answer, real time searches never 'finish'. But they should display all the available results about as quickly as Relative searches. What they don't do is tell you that they have found all the available results - because they are still searching. This can be particularly confusing if you use Time range picker -> All time (real-time) without realising that it is 'special' - it does not show past events, only events that occur after the search started - you'll see that the number of events matched is only, for eg, "28 of 28 events matched" - 28 is the number of events that have matched since your search started. If you were expecting more results, it can seem that it is slow, when in fact, it has actually finished. Officially, this is a feature, even though it may not feel like one. See: http://docs.splunk.com/Documentation/Splunk/6.0/Search/Specifyrealtimewindowsinyoursearch#Real-time_searches_over_.22all_time.22 ... View more

Thanks a lot for your help.. ... View more

Great this is exactly what I needed. If it's not too much trouble can you post the unzip code you used. Thanks ever so much. I am using Founstone too and want to get the scan data directly without the operator having to uncompress the reports. ... View more

The bugs I mentioned are indeed fixed in 4.3.1 and we haven't heard of re-occurrences since. You might want to have a support case opened to look at these errors if they persist beyond 4.3.1. ... View more

That link takes you to the latest known issues. Here is one that goes to the 4.2.4 known issues: http://docs.splunk.com/Documentation/Splunk/4.2.4/ReleaseNotes/KnownIssues I've found that if you delete the deployment app directory on the forwarder out of $SPLUNK_HOME/etc/apps and restart splunkd the app will be re-installed and the problem goes away. This happened on one of my forwarders and that is what I did there. But when it happened on two other forwarders this week I went looking to see if it was a known issue and found this. I've placed the metadata/local.meta in all my apps on the deployment server because the folks that own these three systems don't want to do an upgrade to 6.1.4, which is what I'm installing on all new forwarders and when I do upgrades. The thing is, these forwarders have run a long time without this issue happening, and I wonder what triggered it on these three in a two week period. Odd. ... View more

Dark_Ichigo, If you mean you removed the actual _audit index directory from $SPLUNK_DB, then there is a good chance that there was a duplicate bucket ID that was causing a conflict. An auto-disabled index is often the result of a duplicate bucket ID. There is no natural reason for a duplicate, unless of course you moved/migrated the index from another instance or did something else strange. See this recent post if this was the case: http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing-conflicts-in-my-index?page=1#34834 ... View more