What value did you put into the Attribute query URL field? According to the Splunk documentation, this is the identity provider endpoint where SOAP requests are to be sent. I cannot find any such URI-paths at the iis AD FS web application. ... View more

Could you provide us with some sample data? ... View more

At a customer site I'm serving, 9 out of 10 problems with "missing data" is a mismatch between what is stated in the inputs.conf on the UF side and what is configured on the indexer side (i.e. the index you have in inputs.conf stanzas must also be present (and correctly configured) on the indexer side). A quick way to determine if data is entering your indexes, is to check Manager -> Indexes. Locate your index and check the Earliest / Latest Event columns. Depending on how your access controls with regards to accessing your indexes are configures, you might need to specify index= in the search field. ... View more

Given your example data is in the form of key=value, you probably do not need to create field extractions for these values as Splunk will do this automatically. However, if you can amend the logging of the utm-keys to enclose the values with " (i.e. utma="242832726.1910715443.1325603689.1325603689.1325603689.1") - then you really do not need to create any explicit field extractions as this will ensure that the complete value is used. ... View more

I see no reason why not - but then your infrastructure becomes quite elaborate? ... View more

What you are asking is no different that any other scripted inputs. The only advice is to reformat the data from your snmpget command to something very suitable for Splunk (i.e. key=value). ... View more

The forwarders behavior "out of the box" is to forward data to whatever indexers that are available. In you scenario your secondary indexer could be turned off by default (i.e. not running) - and with some script check if your primary indexer is not running. If the primary indexer is not running - then start the secondary indexer. Seen from the forwarder point of view - this is a "no-brainer" as it will buffer any inputs if your primary indexer dies until it can deliver to your secondary indexer (and vice versa). The problem with this approach might be if you need to search the data from your primary indexer if this becomes unavailable. I have not tried this my self - but this should work. Another approach is to deploy a network load-balancer in front of both indexers, and let this device send data to either your primary or your secondary indexer. ... View more

Could you please elaborate what you mean by "the host is not allowed to install any program"? i.e. is the host where you want to run wget? Also - please provide us with an example of which hosts you want to run what and fetch from where (splunk, wget, datasource used with wget). ... View more

If you just want to count the source / destination pairs without putting the count sums into various buckets, go with imrago's answer. If you need to group the source / destination pairs by a 1 hour timeslot - you might want to try: ... | eval SrcDestPair = src + " " + dest | timechart span=1h count by SrcDestPair ... View more

What are you really asking for? 1) How to count the source/destination pairs OR 2) How to extract nr-something? Please provide us with some sample data. ... View more

You should be able to add indexers to license pools from the command line - see http://docs.splunk.com/Documentation/Splunk/latest/Admin/LicenserCLIcommands ... View more

I have the exact same issue at at customers site, and will have to solve this using a variant of the following search (which might be run on the license server): index=_internal source=*license_usage.log | fields pool b | stats sum(b) by pool Another solution is to forward the license server's Splunk specific log files to your indexer(s) and perform the search there. As a general rule, if you do not (for any operational/security reasons) have direct access (OS level, Splunk GUI) to your forwarders, license servers or indexer's Splunk (log and config) files - getting these into a place where you DO have access is really a must. Your operations people might know how to efficiently run Splunk on the operating system level - but there is no guarantee they know anything about how to manage Splunk. Splunk can be quite complex to manage - and unless the operations people are using Splunk, they will probably not care too much about how the software is supposed to work. \Ruben ... View more

Have you by any chance set up authentication in the Splunk Manager > System settings > Email alert settings dialogue? I.e. entered anything in the Username and Password fields? Based on the error message you posted, it seems that the error message is coming from Zimbra, and that Zimbra is not configures to support authentication by SMTP. Unless your organization is extremely security conscious with regards to how the internal networks components are set up - any kind of SMTP authentication is probably turned off. \Ruben ... View more

One, possible, untested solution, using the CLI: Execute a variant of this search(splunk search 'index="_audit" sourcetype="audittrail" action="alert_fired" | eval trigger_time=strftime(trigger_time,"%Y-%m-%d %H:%M:%S") | dedup ss_name | table trigger_time, ss_name ' -auth user:pass) which return two columns: trigger_time and ss_name. Iterate over the output of #1 as a input to running saved searches with the value of ss_name with trigger_time as an argument to latest= (splunk search '|savedsearch "Name Of Saved Search from #1 above" latest_time="2011-12-20 10:00:31" | table source ' -auth user:pass *) which will return the value of the soruce-field. ... View more