Our Splunk instance is currently setup as a deployment server. All our clients have the Universal Forwarder installed and setup as deployment clients, phoning home to the server to get their necessary apps. Under the "Forwarder Management" page of the Distributed Environment settings, can see all 20 of our clients and their respective host name and IP address actively talking with the server by phoning home and getting apps deployed... However, when I go to the Monitoring Console's, "Forwarders: Deployment" page, only 6 of the 20 Universal Forwarders are showing as installed and active? Sure we're messing up one of the many different config files somewhere but not sure which one... ... View more

Trying to implement an alert on detecting spikes in logged events in our Splunk deployment and not sure how to go about it... For example: Have 15 hosts with varying levels of sources within each... one of my sources in a host averages about 5-6k events per day over the past 30 days; then out of the blue, we're hit with 1.3 million events on one of the days. Assuming the alert would need to be tailored to each host (or source, not sure) and would need an average number of events over a "normal" week to compare to when there's a spike? Any help would be greatly appreciated.   ... View more

Trying to generate Splunk reports for any "ERROR" messages sent to the web application log files over a given week. Ideally, want to be able to use these reports to identify the most prevalent reported errors over that time span, to either have them fixed, or adjust the Splunk filter to ignore specific errors that we can't eliminate. Examples of the sources I want to report on: /data0/crowd-home/logs/atlassian-crowd.log /data0/confluence-data/logs/atlassian-confluence.log /data0/jira-data/log/atlassian-jira.log Not sure how to go about this, any help would be greatly appreciated. ... View more