Hola, lo conseguiste? como pudiste mandar el log de 'alert' a un índice? Tengo la aplicación Splunk_TA_oracle es un Heavy Forwarder pero no se como recibir datos. Me podrías indicar los pasos? Muchas gracias y un saludo. ... View more

Yes, the app will use create a real-time search and run a python event loop and callback for each output you create and enable. In general, if you create a real-time search that models your output and observe the load on the system, multiply that load by 1.5 and that will resemble the load of the real-time output. ... View more

It depends on the kind of forwarder and the type of configuration. You can set sourcetype in inputs.conf and it would be respected for the life of an event with no problem. http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf If setting it in an input isn't possible, because maybe you want multiple sourcetypes from the same input, then its another story. Universal and Lightweight forwarders do not do parsing, so if you're using those, you'd put your changes on the Indexer. If your using a heavy forwarder, you can put your changes there as data would be parsed by the time it left the output queue. http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F ... View more

Hi jonathan.Iam, if you still need an answer on this topic, here is one 🙂 in older Splunk releases it used to be 24 hours before you get into trouble if your license master is gone. Now with Splunk 6.1.3, if the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues). Nevertheless here is the doc about How to swap the license master cheers, MuS ... View more

Check out this previously answered question: http://splunk-base.splunk.com/answers/11457/import-export-user-data On the LDAP question , you would have to manually setup that user in LDAP and setup your LDAP Group to Splunk role mappings. Also bear this in mind (copy/paste from Splunk docs): Usernames in Splunk's built-in authentication system always take precedence over the same usernames in LDAP. So, if you have converted from Splunk's built-in authentication system to LDAP, you might need to delete users from Splunk's built-in system to ensure that you're using LDAP credentials. This is only necessary if usernames are the same in both systems. ... View more

Can you be more detailed about what you are trying to do with monitoring the log files and having them go to separate indexes vs one index. What function are you trying to accomplish. There could be another way. ... View more