If you're deploying your configuration via a deployment server, I believe the config files you are editing on a deployment server should be pushed to etc/apps/deploymentapp, not under etc/system/local. I know in my environment, I don't have anything more than the "[default] host=hostname" in etc/system/local/inputs.conf file, and specify the other items (index=indexname) n the etc/apps/deploymentapp/local/inputs.conf. I would assume(and maybe i shouldn't) that your deployment app should be deployed to etc/apps/production_servers/local/inputs.conf. If your etc/system/local/inputs.conf specifies "index=prod", then I believe it will default all data to that unless otherwize specified in the deployment app in etc/apps/production_server/local/inputs.conf ... View more

Can you provide an example of what you see and what you want to see? Are you looking for something like this where you would convert the data within a field? Or are you not getting fields, and wnat to extract them into a fields? ... View more

To access minutes in your search, you can add the following "| eval min_of_the_day=strftime(_time,"%M") " and search on "min_of_the_day" but there is an issue with my solution as if you're only searching for "min_of_the_day < 31", it will only look at the first half hour of EVERY hour, not just the last one. Unfortunately I'm not good at regex strings, so this is where I have to bow out. ... View more

Ensure the splunkweb service is started. If it is, I would try to restart it and check the windows event logs for any details it could give. ... View more

Ended up using the following, for anyone interested. I just needed to put the carat in the CDATA string. Thanks guys! (index=windows_7 OR index=windows_2008_R2) source=wineventlog:security Process_Name="C:\Windows\System32\winlogon.exe" Logon_GUID!="{00000000-0000-0000-0000-000000000000}" host=$Computer$ user=$User$ | eval hour_of_the_day=strftime(_time,"%H") | where (hour_of_the_day >= 17 <![CDATA[or hour_of_the_day < 6]]>) | timechart count by user ... View more

Still not quite working. Ayn's response cleared the error, but it's not giving the results I would expect. Search line is as follows: (index=windows_7 OR index=windows_2008_R2) source=wineventlog:security Process_Name="C:\Windows\System32\winlogon.exe" Logon_GUID!="{00000000-0000-0000-0000-000000000000}" | eval hour_of_the_day=strftime(_time,"%H") | where (hour_of_the_day >= 17 or hour_of_the_day > <![CDATA[ 6) | timechart count by user]]> ... View more

Works in the search, but not forms. Unfortunately the less than comparator is being seen as part of an html tag in my form so I'm getting "Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 47: StartTag: invalid element name" Any ideas? ... View more

Is it possible you're sending the logs to a non default index? try specifying "index=* host=< >" in the search bar to see if you can see any events from your linux machine. Also ensure you enabled log collection for the new linx machine running as the server under manager -> data inputs. ... View more

Correct me if I'm wrong, but you're trying to send logs from the RHEL 5.6 client via a universal forwarder to your splunk server (indexer). You see data going out from the client, but nothing showing up in the server? While I may not have your solution, a good troubleshooting step would be to go to the splunk indexer and open the splunk.log file under $SPLUNK_HOME/var/log/splunk and see if you're getting any major errors. If that log is clear, I would check the outputs.conf($splunk_home/etc/system/local/) file on the client and ensure it's pointing to the correct server and port: "server = splunk:9997" where splunk is the servername (should be able to ping it) and 9997 is the receive port you specified under Receive data on the server. More information on configuring the outputs.conf can be found at http://docs.splunk.com/Documentation/Splunk/latest/admin/Outputsconf ... View more

Turns out it was the escape character, I tested that before, and it didn't work, tested again to try to digest what the CDATA statement does and it worked, must have fat-fingered it somewhere. So my origional code was correct except for the escape character you recommended. Thanks again! ... View more

When dealing with indexes, a restart of splunk is required to poll the new information. The 'splunk reload deploy-server' will only re-read information pertaining to deployment server and client aspects, whereas the indexes is not thought of as part of the deployment-server/client aspect. Please mark this question as answered for the appropriate person please. Thanks! ... View more

Thank you, thats' what I needed. It appears when I copied the indexes over, the permissions only applied to the folders and not the subfolders and files. Once I applied to all, everything poped in and the errors were resolved. ... View more

It kind of sounds like they aren't able to see the actual index the data is in. Check whether the role they are in has that particular index enabled. It can be found under Manager->Access Controls->Roles->< > and take a look at the Indexes section. If they have ALL the same roles as you have, this wouldn't be the issue, but if you have an extra role, this could be the issue? ... View more

Before you go creating your own search for license usage, have you checked the available apps out there for license usage? http://splunk-base.splunk.com/apps/search/?q=license+usage Please mark as answered if your question has been answered. Thanks! ... View more

Unfortunately that is the extent of my knowledge and what I could find. You could pose this question to support if you don't get an answer here though. ... View more

From http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutdeploymentserver Communication between deployment server and clients The deployment client periodically polls the deployment server, identifying itself. The deployment server then reviews the information in its configuration to find out if there is something new or updated to push out to that particular client. If there is new content to deploy to a given deployment client, the deployment server tells the client exactly what it should retrieve. The deployment client then retrieves the new content and treats it according to the instructions specified for the server class it belongs to--maybe it should restart, run a script, or just wait until someone tells it to do something else. As far as the "splunk restart" vs "splunk reload deploy-server" is concerned, running the first restarts the whole agent, meaning if you run the web interface, it will also shut down, running just the latter will only reload the deployment configurations. Remember to mark as answered if I have answered your questions. Thanks! ... View more

You could try to do what our site did. We put a DNS alias entry on our DNS servers so the IP of the server mapped to 'splunk' and specified 'splunk' as the targetURI. If you ever change which server is the deployment server, you just have to update which IP the alias in DNS points to. ... View more

For linux, you could try: service splunk status Don't know if that works in Unix or not. For a forwarder in my case, it'll give you output along the lines of: Splunk status: Splunkd is running (PID: 7523). splunk helpers are running (PIDs: 7524). ... View more

Did you configure the forwarder to send the data to the Indexer with the outputs.conf? Did you enable data recieving on the indexer? I'm no expert, but you may need to define a whitelist for what logs you do want. Maybe a "whitelist=*" since you appear to blacklist everything you don't want already? The following is an exerpt for a forwarder I use: [monitor:///var/log] whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out) blacklist=(lastlog) index=linuxserver disabled = 0 ... View more