Hi, When load balancing among multiple indexers, would it work if F5 BIG IP is placed in front of the indexers to receive data from Universal Forwarders? Thanks. ... View more

Hi, I need Splunk to recognize the timestamps down to microseconds. A sample event is listed below: 1305096676.192356,64.127.105.40,10.1.81.74, Splunk 4.1.8 automatically(without any extra configuration) recognizes the epoch time down to the milliseconds. But I need the timestamp to be extracted to the microseconds. I have tried using props.conf with the following configuration: [test] TIME_PREFIX = ^ TIME_FORMAT = %s.%6N MAX_TIMESTAMP_LOOKAHEAD = 17 But didn’t work. Any suggestion? Thanks. ... View more

Hi, I needed to use mvexpand in my search(see below), but it limited my search results to 10000 events. Is there a way to increase or diable the limitation? earliest="@d" splunk_server="Splunk4-02" index="rnc" sourcetype="RNC" managedObject_class="WCEL" "HSDPALayeringCommonChEnabled" OR "HSUPAEnabled" | stats values(HSDPALayeringCommonChEnabled) as HSDPALayeringCommonChEnabled, values(HSUPAEnabled) as HSUPAEnabled, values(distName) as distName by host | mvexpand distName ... View more

Hi, I have setup Splunk to listen on udp:514 for syslog input and run into a problem when some logs have single timestamp information and others have multiple timestamp information within the logs. sample log 1 : Jan 31 14:45:17 10.10.10.11 postfix/cleanup[32495]:.........(omitted) sample log 2 : Jan 31 14:46:12 10.10.10.10 Jan 31 14:50:50 Forwarded........(omitted) I need to extract the second timestamp in sample log 2 (10.10.10.10 is extracted to be the host by Splunk) and have tried using the following configuration without success. inputs.conf- [udp://514] disabled = false connection_host = ip sourcetype = syslog props.conf - [host::10.10.10.10] TIME_PREFIX = \w+\s+\d+\s+\d+:\d+:\d+\s+\d+\.\d+\.\d+\.\d+\s+ TIME_FORMAT = %b %d %T MAX_TIMESTAMP_LOOKAHEAD = 50 From another Splunk Answers post "How to Configure timestamps for events with multiple timestamps" gkanapathy mentioned "it is very likely that the host that you see in the event (foo.bar.com) is being set because your sourcetype is syslog. the actual host for a syslog event may or may not be the same". If this were true how do I apply the timestamp extraction config by host? OR is there a workaround? Thanks. ... View more

After enabling the light forwarder on a Windows machine, I noticed that the splunk-regmon.exe and splunk-wmi.exe still run as processes. Since I only use the light forwarder to monitor some application log files, Is it ok to disable the splunk-regmon.exe, splunk-wmi.exe, and spunk-admon.exe by adding the following configuration to inputs.conf in C:\Program Files\Splunk\etc\system\local\ [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 1 [script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path] disabled = 1 [script://$SPLUNK_HOME\bin\scripts\splunk-admon.path] disabled = 1 thanks ... View more

I am monitoring the error.log of a apache server. A single error log file contains events from 2010 to 2011. Splunk is able to parse the timestamp for events from 2010 but failed to parse correctly for events from 2011. All of the events from 2011 got timestamped for 2010/12/31 21:50:47. I searched the _internal index looking for things related to error.log and found the following error messages: 01-25-2011 10:32:29.596 WARN DateParserVerbose - Failed to parse timestamp for event. Context="source::D:\XXXXXXXX\Apache\logs\error.log|host::XXXXXXXX01|apache_error|remoteport::2123" Text="[Tue Jan 04 08:56:53 2011] [warn] [client XX.XX.XX.XX] [4428] auth_ldap authenticate: user XXXXXX ..." 01-25-2011 10:32:29.596 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Tue Jan 4 08:56:53 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. After adding MAX_DAYS_HENCE = 30 to props.conf Splunk was able to parse the timestamp correctly. The apache error log is been forwarded from a remote Splunk light forwarder. Below lists the configuration: inputs.conf on the light forwarder [monitor://D:\XXXXXXX\Apache\logs\error.log] disabled = 0 followTail = 0 sourcetype = apache_error props.conf on the indexer [apache_error] CHARSET = BIG5 TIME_PREFIX = \[ TIME_FORMAT = %a %b %d %T %Y MAX_TIMESTAMP_LOOKAHEAD = 26 MAX_DAYS_HENCE = 30 The system times of the light forwarder and the indexer are within 1 minute of each other and is current. My question is the MAX_DAYS_HENCE is required to parse the timestamp? (some information provided here has been modified and replaced with XX) Thanks. ... View more

Hi, During ad hoc searches we are getting messages "unable to distribute to peer named splunk_index01 at url https://10.1.6.1:8089 because replication was unsuccessful replicationStatus in progress". And when this message displayed, the search results were incorrect. We were getting less events in search resutls than expected. Is there a way to avoid this error? The size of the replication was approximately but less than 300MB. And we had excluded the lookup tables in replication using the configuration below: [replicationBlacklist] donotreplicate = .../*.csv Thanks. ... View more

Hi, I would like to extract timestamp from events where the leading zeros of the time format are omitted. Most of the events have the time format like the example below, where Splunk is able to extract the correct time for the events to be 2010/03/22 11:59:49 pm. 20100322,235949,1=1,52=M2010032223594908434,11=192.168.99.132,2=20 However the leading zeros in the time format are omitted. For exmaple "20100322,314,..." means 2010/03/22 00:03:14 am. Splunk extracts incorrectly for the following event sample to 2010/03/22 10:05:08 pm. The correct time for the event below should be 2010/03/22 02:20:58 am: 20100322,22058,1=1,110=250 U2M2Kv0225593 Message accepted At the extreme end, events with 5 omitted leading zeros in the time format like 20100322,1,1=1,...., and it's timestamp should be 2010/03/22 00:00:01 am. What's best way to extract such time format from the events? If it involves modifying the datetime.xml, please kindly provide the REGEX. Thanks. ... View more

Hi, After upgrading from 4.1.3 to 4.1.4, the field extraction stoppted working. The field extraction configuration involved uisng the REPORT in the props.conf and referenced to the transforms.conf instead of the EXTRACT. An example is as followed: props.conf - [ADM] REPORT-srcIP = ADM_SRC_IP transforms.conf - [ADM_SRC_IP] REGEX = ip=(\d+\.\d+\.\d+\.\d+) FORMAT = SRC_IP::$1 Is using the REPORT in the props.conf to extract field unsupported in 4.1.4? Thanks. ... View more

Hi. Some of the scheduled saved searches have stopped running. When click on these saved searches from Search App's "Searches & Reports" Navigation dropdown menu, the searches run fine. But when click on the "run" link of these saved searches from Manager > Searches and Reports, an error occurred on the web page like the screenshot display below: If the screenshot picture does not display, the actual error message is listed below: "The following requested saved search is unknown""MPLS_login_102_1".As a result, Splunk is unable to redirect to a view." Any suggestions to correct the problem? Thanks. ... View more