This command should be updated to support reverse ordering of colors out of the box. ... View more

Correct, that will work if running the forwarder as the root account. You'll need sudo or root permissions to run the command. $SPLUNK_HOME/bin/splunk enable boot-start If running as a non-root account i.e. splunk, then you'll need to use the -user switch to start it as that user. $SPLUNK_HOME/bin/splunk enable boot-start -user splunk ... View more

I believe the Windows app and Tech Addon only use sourcetypes by default and do not specify an index. Personally, I wish it did specify an index of windows or such. I usually put a global stanza in the inputs.conf file in the [default] stanza for the TA app something like the following. This would default to putting all events in an index named windows. You shouldn't need to update the Windows App on the search head unless you want to try and tune the searches to use an index. I believe they just search by sourcetype by default. #inputs.conf under Splunk_TA_windows\local [default] index=windows ... View more

I would first recommend checking the regex from the search bar to validate the field extraction works. Then, once working, you could move it to props and transforms. i.e. your search | rex field=message (?<my_field>my capture pattern here) ... View more

This is a diagram of Splunk components and network ports that are commonly used in a Splunk Enterprise environment. Firewall rules often need to be updated to allow communication on ports 8000, 8089, 9997, 514 and others. Source files available here: http://downloads.jordan2000.com/splunk/ Updated version Original version ... View more

after further testing, this is my favorite solution Just add the following after your base search and orig_host, orig_sourcetype, orig_source and orig_index will all be in your summary index :-) | rename _raw as orig_raw ... View more

after further testing, this is my favorite solution Just add the following after your base search and orig_host, orig_sourcetype, orig_source and orig_index will all be in your summary index :-) | rename _raw as orig_raw ... View more

after further testing, this is my favorite solution Just add the following after your base search and orig_host, orig_sourcetype, orig_source and orig_index will all be in your summary index :-) | rename _raw as orig_raw ... View more

# a much simpler solution that I got from Splunk guru "D" :-) # turns out renaming the _raw field corrects the issue of missing some of the "orig" fields, i.e. orig_sourcetype # this approach is proabaly not as relavant to Splunk 6 which has many automatic acceleration features # note: the "| collect " command is optional not needed if you are using the summary index checkbox in a saved search index=other | rename _time as time | rename _raw as raw | stats count by time raw index host sourcetype source | collect index=collect ... View more

# a much simpler solution that I got from Splunk guru "D" :-) # turns out renaming the _raw field corrects the issue of missing some of the "orig" fields, i.e. orig_sourcetype # this approach is proabaly not as relavant to Splunk 6 which has many automatic acceleration features # note: the "| collect " command is optional not needed if you are using the summary index checkbox in a saved search index=other | rename _time as time | rename _raw as raw | stats count by time raw index host sourcetype source | collect index=collect ... View more

# a much simpler solution that I got from Splunk guru "D" :-) # turns out renaming the _raw field corrects the issue of missing some of the "orig" fields, i.e. orig_sourcetype # this approach is proabaly not as relavant to Splunk 6 which has many automatic acceleration features # note: the "| collect " command is optional not needed if you are using the summary index checkbox in a saved search index=other | rename _time as time | rename _raw as raw | stats count by time raw index host sourcetype source | collect index=collect ... View more

# I was having trouble recording the raw event, original host, sourcetype and source fields and putting them into a summary index as they were always overridden with the values of the host which runs the search populating the summary index - here's one solution # step 1 - populate summary index # search events from an index namded "other" and prepend the _time, host, sourcetype and source fields to the _raw field with "|" as a delimeter and put into a summary index named "collect" index=other | eval _raw=_time+"|"+host+"|"+sourcetype+"|"+source+"|"+_raw | collect index=collect # step 2 - read from summary index named "collect" # extract time, host, sourcetype and source fields that are stashed in the _raw field in the summary index named "collect" index=collect | rex "^(?<time1>[^|]+)\|(?<host1>[^|]+)\|(?<sourcetype1>[^|]+)\|(?<source1>[^|]+)\|(?<raw1>[^|]+)" ... View more

# I was having trouble recording the raw event, original host, sourcetype and source fields and putting them into a summary index as they were always overridden with the values of the host which runs the search populating the summary index - here's one solution # step 1 - populate summary index # search events from an index namded "other" and prepend the _time, host, sourcetype and source fields to the _raw field with "|" as a delimeter and put into a summary index named "collect" index=other | eval _raw=_time+"|"+host+"|"+sourcetype+"|"+source+"|"+_raw | collect index=collect # step 2 - read from summary index named "collect" # extract time, host, sourcetype and source fields that are stashed in the _raw field in the summary index named "collect" index=collect | rex "^(?<time1>[^|]+)\|(?<host1>[^|]+)\|(?<sourcetype1>[^|]+)\|(?<source1>[^|]+)\|(?<raw1>[^|]+)" ... View more

# I was having trouble recording the raw event, original host, sourcetype and source fields and putting them into a summary index as they were always overridden with the values of the host which runs the search populating the summary index - here's one solution # step 1 - populate summary index # search events from an index namded "other" and prepend the _time, host, sourcetype and source fields to the _raw field with "|" as a delimeter and put into a summary index named "collect" index=other | eval _raw=_time+"|"+host+"|"+sourcetype+"|"+source+"|"+_raw | collect index=collect # step 2 - read from summary index named "collect" # extract time, host, sourcetype and source fields that are stashed in the _raw field in the summary index named "collect" index=collect | rex "^(?<time1>[^|]+)\|(?<host1>[^|]+)\|(?<sourcetype1>[^|]+)\|(?<source1>[^|]+)\|(?<raw1>[^|]+)" ... View more

Ok. I couldn't get the collect command to preserve the orig_host, orig_sourceype, orig_source, etc, however the sistats and sitimechart commands seem to preserve orig_host which you could then send to the collect command ... View more

Thanks, I'll give that a try. I wanting to later do matching of text in the raw field with various other searches against the summary. I'm initially trying to populate the summary with a subset of raw events that I want to search against. ... View more

Having the same issue. How do we store the original host as a field when we are not doing stats/sistats command? Want to associate the original host with the _raw field in the summary. Likewise my summary index only has a subset of events that I've filtered from a sourcetype. ... View more

Thanks! Nice to know just in case... 🙂 ... View more

splunk_app_for_nix-5.0.0-182057.zip, the latest version, has the full app and the TA in a sub directory the zip file. splunk_app_for_nix-5.0.0-182057.zip\etc\apps\Splunk_TA_nix Looks like you can also directly download just the TA in its own tgz file (Splunk_TA_nix-5.0.0-181970.tgz) It appears that the file with the full app and the TA (splunk_app_for_nix-5.0.0-182057.zip) has a slightly newer version of the TA though (build = 182057) where is the TA only file (Splunk_TA_nix-5.0.0-181970.tgz) has a version (build = 181970) according the the app.conf file contained within. ... View more