If you have console access then you dont need a scripted install. Just install splunk on any computer and copy the certificate generated by the fresh install to the windows 2000 machine. ... View more

Actually this issue was also clarified in this question: http://answers.splunk.com/answers/26571/unable-to-search-for-extracted-substring-if-didnt-startend-with-word-boundary-in-the-string-it-was-extracted-from ... View more

Thanks, that info was not present in the documentation for v6.0 but $click.name2$ worked 😉 Still not sure how to use the series attribute in the link tag but, for now the issue is solved! ... View more

The datamodel indexes should be in the app DB directory on your indexers. $SPLUNK_DB/pan_logs/datamodel_summary/ /opt/splunk/var/lib/splunk/pan_logs/datamodel_summary/ ... View more

The PAN app did not consider larger amounts of data being collected. We have 1 day acceleration and the file system has already surpassed 300GB. ... View more

Ok, I just found the problem. The copy of the user folders from the Indexer to the Search head resulted in invalid folder ownership and permissions on the Search Head. So, not even the admin could see the objects. Actually, users were not even able to save new searches but that had not been reported until now. The issue was happening in MOST of the folders, but not all, that's why some objects were being listed. Then, somehow the Window Server was not allowing Ownership changing (folders had "unknown user") so we had to re-copy everything again but this time it worked 😉 ... View more

note: Configuring the dispatch.earliest_time over the UI like shown in the post above will set the [general_default] stanza in user-prefs.conf (so not in ui-prefs.conf) (seen/verified in splunk 7.1.6) ... View more

What I would do: User, roles, authentication: - Copy $SPLUNK_HOME/etc/passwd (your user-password-roles pair) - Copy authorize.conf from $SPLUNK_HOME/etc/system/local/ (your roles definition) App/searches/Views. Locate your apps on $SPLUNK_HOME/etc/apps/ If you do everything in "search" app, don't copy the search app folder completely as it might give you headache later on when you upgrade. I'll do the following inside of the search app: - copy your "local" folder (it has your searches, views, macros, lookups) - copy metadata/local.meta if you want to preserve who owns what searches (it's not important) For other apps that you have created from barebone template, you can simply copy over the whole app folder. This works well in my experience. ... View more

I spent too much of a day trying to figure out why 2 of 5 servers were not showing up in my Indexer. I tried removing then adding the forward-server information, restarting the forwarder over and over and even reinstalling the forwarder on each, but they just didn't show up. Using telnet I confirmed the connection was open and the Indexer was listening. In the forwarders' splunkd.log files I confirmed the connection was being made. Finally I happened to change my search string to "index=_internal host=*" and there they were, but there was only one source from each and it was $SPLUNK_HOME/var/log/splunk/splunkd.log. The other 3 servers that were working had many more sources. A little bit more searching and I found this command: $SPLUNK_HOME/bin/splunk list monitor Sure enough, only splunkd.log was being forwarded. So I ran: $SPLUNK_HOME/bin/splunk add monitor /var/log This was what the "working" servers showed in their "list monitor" results. When running "host=*" in the search app, there were the 2 servers that wouldn't work before. ... View more

Hi We got exactly the same problem - how did you fixed it? Would appreciate any help- thx ... View more

Note that your postprocess there will simply count the number of timebuckets coming out of the timechart, not the number of actual events being counted in the timechart. read the postprocess documentation in Sideview Utils ("Key Techniques > Using PostProcess > Introduction" to get a good overview and an illustration of various pitfalls involved. ... View more

Convert your lookup to not have accented characters. Is the splunk machine nix based? If so, try using dosutils.... dos2unix [filename] to convert to proper format. Also try using notepad++ not notepad... never use notepad for ETL. ... View more

It happens that because your two time ranges are adjacent, you could do something simpler, though it's only marginally so. And it less efficient if the time ranges have a large gap between them: index=summary source=dailysearch OR source=hourlysearch earliest=-7d@d latest=now | stats count(eval(source=="dailysearch")) as dailysum count(eval(source=="hourlysearch")) as hourlysum However, I would also note that it's a good idea to store different densities of summary (e.g. daily vs hourly) into different indexes, because you'd then be able to archive/delete, e.g., all the hourlies after one month, while keeping all the dailies for two years, and save on disk space. ... View more

This seems like a good idea (I haven't looked at it) but note that 4.2 is coming out soon and it will have several additional index parameters for setting and controlling indexing sizes, so you may want to take a look at the new docs and spec file to see about updating it. ... View more

You can utilize the settings in the LightForwarder app that send the internal logs onto the indexer. However, this only changes where the logs are located. To do this, you must edit the inputs.conf on your forwarder to reflect the following: [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] _TCP_ROUTING = * index = _internal [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] _TCP_ROUTING = * index = _internal 10% utilization is not uncommon for a full forwarder if it is doing some heavy processing. Without more detail of your inputs, this will be hard to diagnose. ... View more

Okay, What is not working? I have created a SOP that is specific to my environment, but I am happy to share it with you. There is a link I posted on how to setup a ARR reverse proxy through IIS. The key is to install the models in the sequence listed above. After that point IIS to the Splunk\bin folder, then ensure ISAPI_Filters have entries to the Helicon ISAPI models, then configure URL Re-write to turn on the proxy component of ARR. My helicon httpd.conf looks like the following: i. #Helicon ISAPI_Rewrite configuration file HTTPD.CONF ii. # Version 3.1.0.104 iii. # iv. RewriteEngine on v. RewriteLogLevel 0 vi. LogLevel info vii. RewriteCond %{REMOTE_USER} .\([^\]+) viii. RewriteHeader Remote-User: . %1 ix. RewriteBase / x. RewriteProxy ^(.*)$ [NC,P] Lastly there is some tweaking in the \etc\system\web.conf to enable SSO. HTH ... View more