Are there default configuration files that you can share so that the data gets populated in the default reports/dashboard tiles once we inject cisco ASA/PIX/FWSM/IPS/ironport(web) data? I need info on how to configure the files listed below so that the various firewall/ironport(web)dashboards & report data for the cisco security app get populated. [root@splunk default]# ls -ltr total 44 -rw-------. 1 root root 44 Jan 16 13:40 transforms.conf -rw-------. 1 root root 18310 Jan 16 13:40 savedsearches.conf -rw-------. 1 root root 59 Jan 16 13:40 props.conf -r--------. 1 root root 0 Jan 16 13:40 eventtypes.conf drwx--x--x. 3 root root 4096 Jan 16 13:40 data -r--------. 1 root root 315 Jan 16 13:40 viewstates.conf -r--------. 1 root root 61 Jan 16 13:40 macros.conf -rw-------. 1 root root 546 Jan 16 13:40 app.conf ... View more

I would like to spearate general query utilization between various groups. Example: only allowing Scruirty personnel the ability to look at logs from specific security devices. Is this possible? ... View more

So I have two ha pairs that I want to set distributes searches on: Pair-A-1 10.10.10.5 Pair-A-2 10.10.10.6 VIP 10.10.10.7 Pair-B-1 172.16.1.11 Pair-B-2 172.16.1.12 VIP 172.16.1.13 How do I setup the peers? Pair-A-1: Peer 172.16.1.13:8089 (By Vip) or Peer Pair-B-1:8089 (or Peer 172.16.1.11:8089) Peer Pair-B-2:8089 (or Peer 172.16.1.12:8089) ... View more

I have a search that is taking a few days to run. Here is the search string: sourcetype="bcoat_proxysg" | stats dc(c_ip) by date I send the search to the background and can continue to work but I want to know if there is a way to speed up the this search. Thanks. Other information: Running Splunk 4.0.11 PowerEdge R710 Linux 2.6.18-92.el5 CentOS 5.2 load average: 1.39, 1.92, 4.95 MemTotal: 24675796 kB MemFree: 10980696 kB ... View more

This has happened twice so far in a week. Users begin contacting me that they are unable to log in. Both times I ran a netstat and I saw: ADMIN: Exiting (status = 0) ... tcp 0 0 127.0.0.1:31337 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:50259 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:30259 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8666 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8444 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8222 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN unix 2 [ ACC ] STREAM LISTENING 7956 /var/run/dbus/system_bus_socket unix 2 [ ACC ] STREAM LISTENING 7997 /var/run/acpid.socket unix 2 [ ACC ] STREAM LISTENING 7894 /dev/log splunkd 3517 root 3u IPv4 8307 TCP *:8089 (LISTEN) splunkd 3517 root 38u IPv4 8399 TCP *:30259 (LISTEN) splunkd 3517 root 40u IPv4 8401 TCP *:50259 (LISTEN) I checked multiple files within /var/log/*. Both times I restarted splunk and checked the netstat and https is now up. ADMIN: Exiting (status = 0) ... tcp 0 0 127.0.0.1:31337 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:50259 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:30259 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8666 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8444 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8222 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN unix 2 [ ACC ] STREAM LISTENING 7956 /var/run/dbus/system_bus_socket unix 2 [ ACC ] STREAM LISTENING 7997 /var/run/acpid.socket unix 2 [ ACC ] STREAM LISTENING 7894 /dev/log splunkd 22529 root 3u IPv4 345937 TCP *:8089 (LISTEN) splunkd 22529 root 39u IPv4 346009 TCP *:30259 (LISTEN) splunkd 22529 root 41u IPv4 346011 TCP *:50259 (LISTEN) Where should I start looking to trouble shoot this issue? Thanks. ... View more