i still get the rollback error 😭 ... View more

Oh yeah I did that. also, I was making use of REPORT instead of TRANSFORM in props.conf this is what worked: Props.conf [source::ping] TRANSFORMS-add_static_fields = mystaticFieldValue Transforms.conf [mystaticFieldValue] SOURCE_KEY = _raw WRITE_META = true REGEX = (.*) FORMAT = item::31 Fields.conf [item] INDEXED = true ... View more

The curl call that changes an app permission looks like :   curl -s -k -u admin:<ADMIN_PASSWORD> --request POST "https://localhost:8089//services/apps/local/<APP_NAME>/acl" -d sharing=global -d owner=nobody   The required sharing  parameter indicates how the resource is shared: sharing   app: Shared within a specific app global: (Default) Shared globally to all apps. user: Private to a user   The details are available here: REST API doc  ... View more

My first guess is that this is likely down to excessive or inefficient REGEX operations during parsing. It could be index-time extractions or even field-replacement/masking operations. Another possibility is a lack up of-front sourcetyping at the input layer, if Splunk doesn’t know what sourcetype to apply to data it will try and figure it out itself on each event, which is obviously not a good idea. I would review all inputs, props and transforms entries to see if you can spot any outliers or operations that have been applied to most or all of the incoming data. Alternatively there’s this app on Splunkbase – Data Curator: https://splunkbase.splunk.com/app/1848/ - which will provide efficiency scores on all sourcetypes based on *.conf file entries. It hasn’t been updated in a while so still says it’s for 6.2, but I expect it to work on 6.4.x as well. ... View more

This comment deserves way more karma than I can currently allocate ... View more

At present, and somewhat to Flynt's point, it appears if you have already gone through the process of creating a saved search and didn't select to not have a visualization the only way to disable the visualization is to add the following to the appropriate stanza in the savedsearch.conf file. There is perhaps something in the UI that I have missed. display.visualizations.show = 0 ... View more

By default, Splunk forwarders will always use auto-LB when forwarding to any destination, Splunk indexer or otherwise. The forwarder will only use round-robin when you configure it to, but this is unlikely to work well when using a universal forwarder, as it will not parse the data before sending. ... View more

Thanks Mick for your help Stanza I mentioned above is wrong, Sorry Splunk instance is collecting data from the web server. The actual stanza I wrote on input.con file is [monitor://C:\inetpub\logs\LogFiles] original {d:\iislog\LogFiles} disabled = false followTail = 0 sourcetype=iis Actually problem is backfilling not done properly. Now everything is working. Thanks ... View more

Thank you, thats' what I needed. It appears when I copied the indexes over, the permissions only applied to the folders and not the subfolders and files. Once I applied to all, everything poped in and the errors were resolved. ... View more

Never make changes to the files in default! Always make changes to the equivalent file in the local space, in this case /opt/splunk/etc/system/server.conf and web.conf. Making changes in default may be overridden when Splunk is upgraded. See http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Howtoeditaconfigurationfile ... View more

Currently, no, but the new 4.3 release in early 2012 will support IPv6. We're in the final testing stages right now. ... View more

A quick way to do this via splunkweb is via http:// : /_bump ... View more

Agreed. I have a 32 bit box and removed the 64-bit firefox to save space as well. ... View more

On version 4.3.4, I copied the file from the "search" app and added this to the equivalent spot. (I've removed the angle brackets to ensure it appears.) param name="default" index=myindex /param I ran "splunk btool fix-dangling" as I use pooled search heads. I had to log out and back in to see the change. ("index=myindex" appears automatically in the search box.) All seems to be working well in the short time it's been modified. ... View more

Splunk App for Microsoft Exchange has now been released for your use. ... View more

if you have a zoom with your brownser you might be able to better see the screenshots [i did it here before posting it and worked, but i'm sorry for this]. Mick probably what you are saying it's what happened, because before i attempt to forward this .csv file I indexed on the receiver another .csv file format. however, how i said i thought that cleaning the indexes would solve my problem but it didn't. Here it's what i found in the receiver's props.conf: [csv-2] KV_MODE = none REPORT-AutoHeader = AutoHeader-1 SHOULD_LINEMERGE = False pulldown_type = true ... View more

"...are more true of the T1..." ... View more

It's not currently possible but we will add that to the list of enhancement requests ... View more

submitting support ticket seems to have done nothing (haven't heard back at all)... that was on Jan 11, 2011. 2+ months seems like a long time, even for free support. And with 4.2 out today, I was hoping against hope we'd see 64-bit, but alas, still 32-bit. Anything? ... View more

I can see lots of files and directories in %SPLUNK_HOME\var\lib\splunk\defaultdb\db it looks like the following but with different dates and numbers, obviously. 04/07/2010 09:57 AM db_1219018015_1219018015_24 04/07/2010 09:57 AM 0 db_1219018015_1219018015_24.sentinel 06/05/2010 02:10 PM db_1223363806_1192723204_31 06/05/2010 02:10 PM 0 db_1223363806_1192723204_31.sentinel 04/05/2010 09:41 AM db_1226784675_1219014387_2 ... View more

During the first start up after the upgrade, Splunk tries to validate the existence of all declared indexes in the indexes.conf found in your configuration directories. Even if an index is disabled with "disabled = true" or by being present in the indexes.conf of a disabled app, Splunk will freak out if it cannot locate it's "homePath" (whether it's the default one in $SPLUNK_DB or a custom one specified in indexes.conf). The quickest way to troubleshoot this problem is to compare the output of two commands. The first one displays all existing index configuration stanzas across all indexes.conf : # find $SPLUNK_HOME/etc/ -name indexes.conf | xargs grep ^\\[ The second command will list the directories present in $SPLUNK_DB ($SPLUNK_HOME/var/lib/splunk/ by default), which is the default "homePath" for each index if no other value for that parameter is specified. # ls -l $SPLUNK_DB or # ls -l $SPLUNK_HOME/var/lib/splunk/ If the first command shows an index that is not present in $SPLUNK_DB and that index doesn't have a setting for "homePath" that points to an existing directory, you should consider disabling that index stanza in that configuration file by preceding it with a "#". Typical culprits are "splunklogger" (which has been deprecated and is often present but disabled) and "os" (which is often present in disabled apps like "unix" or "nixLF"). This is particularly effective on a forwarder where there shouldn't be any indexes configured other than what can be found in $SPLUNK_DB. Here's a typical scenario : 1) Which index directories exist? # ls -l $SPLUNK_DB total 52 drwx--x--x 5 root root 4096 Jun 25 16:29 audit drwx--x--x 2 root root 4096 Jun 25 10:14 authDb drwx--x--x 5 root root 4096 Jun 25 16:29 blockSignature drwx--x--x 5 root root 4096 Jun 25 16:29 defaultdb drwx--x--x 6 root root 4096 Jun 25 16:29 fishbucket drwx--x--x 2 root root 4096 Jun 25 16:29 hashDb drwx--x--x 5 root root 4096 Jun 25 16:29 historydb drwx--x--x 5 root root 4096 Jun 25 16:29 _internaldb drwx------ 2 root root 4096 Jun 25 16:29 persistentstorage drwx------ 2 root root 4096 Jun 25 16:27 queues drwx--x--x 5 root root 4096 Jun 25 16:29 sample drwx--x--x 5 root root 4096 Jun 25 16:29 splunkloggerdb drwx--x--x 5 root root 4096 Jun 25 16:29 summarydb 2) Which indexes are declared in the configuration files? # find $SPLUNK_HOME/etc/ -name indexes.conf | xargs grep ^\\[ etc/system/default/indexes.conf:[main] etc/system/default/indexes.conf:[history] etc/system/default/indexes.conf:[summary] etc/system/default/indexes.conf:[_internal] etc/system/default/indexes.conf:[_audit] etc/system/default/indexes.conf:[_thefishbucket] etc/system/default/indexes.conf:[_blocksignature] etc/system/default/indexes.conf:[splunklogger] etc/apps/sample_app/default/indexes.conf:[sample] etc/apps/nixLF/default/indexes.conf:[main] etc/apps/nixLF/default/indexes.conf:[history] etc/apps/nixLF/default/indexes.conf:[summary] etc/apps/nixLF/default/indexes.conf:[_internal] etc/apps/nixLF/default/indexes.conf:[_audit] etc/apps/nixLF/default/indexes.conf:[_blocksignature] etc/apps/nixLF/default/indexes.conf:[splunklogger] etc/apps/unix/default/indexes.conf:[os] etc/apps/SplunkLightForwarder/default/indexes.conf:[main] etc/apps/SplunkLightForwarder/default/indexes.conf:[history] etc/apps/SplunkLightForwarder/default/indexes.conf:[summary] etc/apps/SplunkLightForwarder/default/indexes.conf:[_internal] etc/apps/SplunkLightForwarder/default/indexes.conf:[_audit] etc/apps/SplunkLightForwarder/default/indexes.conf:[_blocksignature] etc/apps/SplunkLightForwarder/default/indexes.conf:[splunklogger] This revealed the following culprits : etc/apps/unix/default/indexes.conf:[os] etc/system/default/indexes.conf:[splunklogger] etc/apps/nixLF/default/indexes.conf:[splunklogger] etc/apps/SplunkLightForwarder/default/indexes.conf:[splunklogger] The "splunklogger" index was disabled everywhere it was declared with "disabled = true", and the "os" index was not in use as the unix app was disabled. Once these stanzas and all of their associated parameters were commented out, the upgrade worked! ... View more

Rest assured that the volume reported as being indexed to _thefishbucket does NOT count against your license. ... View more