Hi to all, I had a deployment server (server A), an indexer/search head (server B) and some monitored servers. I copied the folder deployment-apps by deployment server to indexer and deleted the deployment server (deleted server A and used server B as deployment, indexer and search head) In each monitored server I manually changed in /opt/splunkforwarder/etc/system/local/deploymentclient.conf the targetUri IP. I restarted splunk server (server B) , in forwarder management I see "No clients phoned home". what is missing? ... View more

Hi to all, I installed on monitored server, by universal forwarding, an app that uses python script to load data about cpu, disk,.. The app contains a file table2event.py that start with: #!/usr/bin/python import time import logging import urllib2 as u import os import subprocess import sys global log In splunkd.log I see several errors like ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/ta-adapter/bin/table2event.py iostat.sh" /bin/sh: \r: No such file or directory How can I solve? Thanks, Andrea ... View more

Hi to all, I configured a forwarder as following In Splunk Server: - in /opt/splunk/etc/deployment-apps I copyed the forwarder apps (fwd_common, fwd_jboss,..) - in /opt/splunk/etc/deployment-apps/fwd_common/default/outputs.conf I inserted [tcpout] defaultGroup = ovdgroup [tcpout:ovdgroup] server = splunkserverIP:9997 autoLB = true in /opt/splunk/splunk/etc/system/local/serverclass.conf I inserted [serverClass:FWD_JBOSS] whitelist.0 = monitoredserverhostname [serverClass:FWD_COMMON] whitelist.0 = monitoredserverhostname I set the inputs.conf files in order to analyze log files. In Forwarder management, in "Clients" tab, I can see the client (Jboss Server) that "Phoned Home" a few seconds ago and in "Apps" tab I can see the apps deployed. The indexes that should be populated by jboss log files are empty. Wich checks can I perform in order to understand why indexes are empty? Thanks, Andrea ... View more

Hi to all, I need to install UF on several linux hosts in order to monitor them. Do I need to access on each single host andbto install the UF as indicated here https://docs.splunk.com/Documentation/Forwarder/6.6.1/Forwarder/Installanixuniversalforwarder or there is some way to install directly by the deployment server? Thaks, Andrea ... View more

Hi to all, I have a summary search that doesn't produce results, if I copy and paste the same search in "search & reporting" app, I can see the results. I noticed that this search is slow, results appears after quite a minute, is it possible that launching the search in summary search it goes in timeout? Or there is another reason for which summary search doesn't produce results? Thanks, Andrea ... View more

Hi to all, I'm using a csv file to categorize event actions extracted by a log file. I'm extracting events action (i.s. getxxx) using a regular expression, then I use the lookup command to search the action in the csv file and to extract the relative category. Since the event action is like IP/getxxx and the IP is variable, I'd like to set the csv file like */getxxx in order to match for any IP, but the * in the csv file doesn't work. How can i solve? Thanks, Andrea ... View more

Hi to all, I should extract some fields by a log file, in the log file in some cases I have a field (i.e. field1, in other cases I have another field (i.e. field2). For example the log file can contain field1=value1 or field2=value2 I need to do something like IF log contains filed1 EXTRACT- field1 =.*field1=(?P<field1>\w+).* ELSE EXTRACT- field2 =.*field2=(?P<field2>\w+).* Is it possible? Thanks, Andrea ... View more

Hi to all, I'm sizing a Splunk architecture, I'm trying to know how data encryption and compression impact on performance. For example, if I enable data compression and encryption, do I need to size CPU to x % higher? Thanks, Andrea ... View more