If you want to automate this and getting the "latest" files: wget --content-disposition 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=latest&product=splunk&filename=.tgz&wget=true' platform=linux platform=macos product=universalforwarder product=splunk   MacOS: architecture=x86 Windows platform=windows filename=.msi Feel free to guess the other options.   Holger ... View more

You output is hard to read... Here an example from my test env: /etc/system/default/outputs.conf [syslog] /etc/system/default/outputs.conf dropEventsOnQueueFull = -1 /etc/system/default/outputs.conf maxEventSize = 1024 /etc/system/default/outputs.conf priority = <13> /etc/system/default/outputs.conf type = udp /etc/apps/fwd_sendtoindexer/local/outputs.conf [tcpout] /etc/system/default/outputs.conf ackTimeoutOnShutdown = 30 /etc/system/default/outputs.conf autoLBFrequency = 30 /etc/system/default/outputs.conf blockOnCloning = true /etc/system/default/outputs.conf blockWarnThreshold = 100 /etc/system/default/outputs.conf compressed = false /etc/system/default/outputs.conf connectionTimeout = 20 /etc/apps/fwd_sendtoindexer/local/outputs.conf defaultGroup = default-autolb-group /etc/system/default/outputs.conf disabled = false /etc/system/default/outputs.conf dropClonedEventsOnQueueFull = 5 /etc/system/default/outputs.conf dropEventsOnQueueFull = -1 /etc/system/default/outputs.conf forceTimebasedAutoLB = false /etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.0.whitelist = .* /etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.1.blacklist = _.* /etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.2.whitelist = (_audit|_introspection) /etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.filter.disable = false /etc/system/default/outputs.conf heartbeatFrequency = 30 /etc/system/default/outputs.conf indexAndForward = false /etc/system/default/outputs.conf maxConnectionsPerIndexer = 2 /etc/system/default/outputs.conf maxFailuresPerInterval = 2 /etc/system/default/outputs.conf maxQueueSize = auto /etc/system/default/outputs.conf readTimeout = 300 /etc/system/default/outputs.conf secsInFailureInterval = 1 /etc/system/default/outputs.conf sendCookedData = true /etc/system/default/outputs.conf sslQuietShutdown = false /etc/system/default/outputs.conf tcpSendBufSz = 0 /etc/system/default/outputs.conf useACK = false /etc/system/default/outputs.conf writeTimeout = 300 /etc/apps/fwd_sendtoindexer/local/outputs.conf [tcpout-server://10.204.240.180:9997] /etc/apps/fwd_sendtoindexer/local/outputs.conf [tcpout:default-autolb-group] /etc/apps/fwd_sendtoindexer/local/outputs.conf server = 10.204.240.180:9997 splunk list forward-server Active forwards: None Configured but inactive forwards: 10.204.240.180:9997 I would switch of idxAck and IndexerDiscovery until you have everything up and running... Are you sure your input is active? Maybe keep it simple? My outputs.conf... [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = 10.204.240.180:9997 [tcpout-server://10.204.240.180:9997] ... View more

Please send the output of btool and search for TcpOutput error messages in index=_internal. is your forwarder included in the search results if you do the following search? | tstats count where index=* OR index=_* by host,index HTH, Holger ... View more

Hi, you should post your answers as an answer and mark it as "resolved"... so people can see the result better 🙂 Holger ... View more

Hi, please run /apps/splunkforwarder/bin/splunk btool outputs list --debug | less on your forwarder and check whether the outputs.conf is really active. Did the forwarder do a restart? HTH, Holger ... View more

Hi, why don't you use the time stamp as the event break? https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Configureeventlinebreaking BREAK_ONLY_BEFORE_DATE In your case this should work pretty well because ALL lines are starting with the four letter status and the timestamp... no matter if there is a Java stack trace or anything else... HTH, Holger ... View more

Hi, there is a field called "linecount" in every event. (You need smart mode or verbose mode). HTH, Holger ... View more

Hi, in addition, to get a table again, you can add two commands: ...| fields -_raw | table * Even if the raw events are still displayed as a JSON object with long names you'll get a table like with DBConnect 1.x (and short column names). HTH, Holger ... View more

Hi, I use an older Ubuntu LTS 12.04 environment (to lazy to update 🙂 and have DBConnect 1.2.2 and DBConnect 2.1.x installed in parallel. To upgrade to the latest Java 1.7 (OpenJDK) and Java 1.8 (Oracle!!!!) version these URLs helped... Java 1.7. http://askubuntu.com/questions/48468/how-do-i-install-java sudo apt-get install openjdk-7-jre Java 1.8. Oracle! http://tecadmin.net/install-oracle-java-8-jdk-8-ubuntu-via-ppa/# OpenJDK 1.8 does not work!!!! http://ubuntuhandbook.org/index.php/2015/01/install-openjdk-8-ubuntu-14-04-12-04-lts/ HTH, Holger ... View more

Hi 1) jepp. There will be some overhead. Since there are not millions of buckets I don't think this will be an issue... 2) Every indexer will try to copy "it's own" bucket to HDFS. If there is already a valid copy of this bucket the indexer will skip this. There should be no duplicates. HTH, Holger ... View more

I haven't tried it myself but maybe because HBase provides a SQL interface the DB Connect App might help?!?! Looks like an option: http://answers.splunk.com/answers/173460/does-hunk-read-data-from-hbase.html HTH, Holger ... View more

Sorry, missed the edited link completely... Cool stuff and tips... worth trying! Thank you! ... View more

Hi, great article. Just found out that splunk btool check will do the same checks as a splunk start Example: (Typo SOULD_LINEMERGE instead of SHOULD_LINEMERGE) Invalid key in stanza [myst:test] in /opt/splk/splunk-624/etc/apps/aa_test/local/props.conf, line 2: SOULD_LINEMERGE (value: true) HTH, Holger ... View more

Just as a pointer to the right answer: http://answers.splunk.com/answers/128538/ta-for-iis-that-follows-the-common-information-model.html ... View more

Well. The first one is JS magic. Looks cool but not exactly my point. And no map mantioned there????? I was talking about the Splunk Pivot function which relies on a data model. TStats... that's another option, indeed. Pipe this output to geostats. But it's only working if you have accelerated the data model. Would look like this: | tstats .... | iplocation ip_field ... | geostats ... Turn it into a map. Good idea. Still manual work 🙂 Thank you, Holger ... View more

Hi, in addition to martin's answer: No, a field must not necessarily exist in every event. If it's there, you see it in the line under the event even if the event view is not expanded. If you want to see only events with this field you can type "fieldname=*" in the search or click on the field in the list of "interesting fields" and select "only events with this field" which adds this attribute to the search. But beware this can slow down your search. HTH, Holger ... View more

I assume with multisite clustering most of the concerns are solved. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Multisitedeploymentoverview HTH, Holger ... View more

Hi, take a look a the docs: http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/Referencehardware http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/Distributedoverview http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/HardwarecapacityplanningforadistributedSplunkdeployment HTH, Holger ... View more

Hi, I am afraid you won't like this answer... Question: How much data is indexed/day? How many concurrent users on the SearchHeads, what are the use cases? Using NFS for hot/warm storage won't work for most of the NFS implementations. Using NFS for cold storage (longtime storage) would work. Take a look here: http://answers.splunk.com/answers/250/can-splunk-read-data-to-index-off-an-nfs-mount-can-splunk-store-indexed-data-to-an-nfs-mount.html Splunk Enterprise needs high speed disk storage to index data. http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/HardwarecapacityplanningforadistributedSplunkdeployment http://docs.splunk.com/Documentation/Splunk/6.1.4/Installation/CapacityplanningforalargerSplunkdeployment For more details on IOPS see here: http://answers.splunk.com/answers/84340/how-many-iops-can-i-expect-from-a-disk.html HTH, Holger ... View more

OK, after some troubleshooting I found out that the MongoDB app requires Java 1.7 (as mentioned by Damien). One important thing: Configure your virtual index to use the correct database! It might be useful to switch on the verbose logging of MongoDB to see whether the requests from HUNK are correct. Damien, Thank you!!! ... View more

OK, update to OpenJDK 1.7.0.x was successful. No errors regarding version mismatch anymore. ... View more