Except that it doesn't apply RBAC view of the indexes. Except that it doesn't work if you can't reach indexers on 8089 and don't have indexes configured on your SH. Except that it's not as fast as eventcount and probably shouldn't be used in dashboard drop downs. ... View more

@gdiazlo  I am linux newbie.  What information this script suppose add?  We're getting an error severity with "<no matches>"  what does that mean? ... View more

I know this topic may be old but I wanted to add, that this solved my scripted input problem too.    I had a script in which I change some things and then want to restart splunk - only with the statement /opt/splunkforwarder/bin/splunk restart > /dev/null 2>&1  it works perfectly. otherwise, when I leave 2>&1 out it results in splunk stopping but simultaneously killing the skript process too. so splunk can't come up anymore. so, thanks for that valuable information ... View more

What I've learned with summary indexing and transactions is there are some inconsistencies in the collection of the data ... It turned out I have to do the transaction in the summary index, not before because my main concern with the duration ... I am collecting VPN logs. so I ended up using a join command to gather my events, used collect to push them into the summary index and then I run the transaction command using the startswith/endswith and eval on the fields.. that solved a big part of my problem. | join session_id [ search agency=sales] .... this gathers all my relevant events with a session_id field and narrows the grouping down by doing a search for the field agency=sales I also found out that I had to create all new field extractions using the sourcetype=stash because that is what the summary index uses ... other summary indexes will also use the same sourcetype=stash too, although I think you can force a different name ... luckily I didn't need to figure that out. Maybe this is useful, maybe not ... but thought I would try ... Oh, and remember to make sure your in smartmode instead of fast mode for field discovery ... View more

The sideview utils example seem to work only with splunk 5.x 😞 ... View more

Seems to be related to this one, anybody can confirm this ? http://answers.splunk.com/answers/40799/fs-change-keeps-adding-and-deleting-files-from-monitoring?page=1&focusedAnswerId=98160#98160 ... View more

Interesting enough this wiki page has not been changed and it still seems I have to assign sourcetypes in both the inputs.conf and the props.conf on the UF to catch all the information I need (file content AND the file / change metainformation) (so the wiki page actually seems to be correct) ... View more

Hi Unfortunately neither work. I try to set the source-type based on the directory the file comes from while using a fschange stanza. Setting the sourcetype in inputs.conf does not work as intended but overwrites the sourcetype set by the fschange module (that I need to keep), so setting it in props.conf works fine for me. Besides that I need to treat the files from the listed directories in a special way and ONLY those from those directories. A lot of other files / directories and the like from the same host are fed into splunk but I need not to interfere with their processing. BUT as I wrote above it also applies the rules to a directory like /somedir_/testing2/some_file which it should not do actually so I would like to have the regex stick to the beginning of the source (which is the directory and filename ...) Any ideas ? ... View more

Seems like the MORE_THAN / LESS_THAN operators don't actually work as expected , was corrected in the docs already 😞 ... View more

It seems because of a lack of recursive sourcetype matching this is not really solvable by now 😕 Solved it by setting the sourcetype on the forwarder and doing some processing on the indexer. Recursive matching of at least 1 level seems like a needed feature. ... View more

Note: Monitor inputs should not overlap. That is, monitoring /a/path while also monitoring /a/path/subdir will produce unreliable results. Similarly, monitor inputs that watch the same directory with different whitelists, blacklists, and wildcard components are not supported. Sounds like a splunk limitaton here 😕 ... View more