Can Splunk Light Free forward some logs to a third party server? Ex. I have Splunk Light free monitoring some log files on on a remote server and I'd like to filter some of those logs in real-time and send them to another syslog-capable server (Solarwinds in this case). Why? Because I have Alerting Capabilities on Solarwinds and I don't have that on Splunk Light Free (Besides, I have all Alerts already implemented on Solarwinds and I prefer to centralize the alerting functionality there, for management purposes). ... View more

I need to index and search Event Logs from a few Windows 7 and 8 Desktops, but I don't use a Domain Controller. This app has some prerequisites on the Configuration page, and it won't let me continue unless I specify AD parameters. How can I use this app without a Domain Controller? Dotty... ... View more

I have been using "alerts to email" for a while already,, now I need to create an alert that triggers if a particular message is not seen on certain period. Basically, I get a confirmation on Splunk via syslog after a script runs on one of my servers, and I need Splunk to tell me if the script didnt run on a particular day. Thanks ... View more

Im extracting values on a field with this Reg ex: <technology[^>]*>(?P<Technology>[^<]+) It returns different values when uppercase and lowercase,, for example: Audio AUDIO audio How can I make it ignore the Case? Thanks guys!! ... View more

I created my first dashboard and it looks great, I would like to create a few (for CEO, Operations, etc),, but I would like to disable the Searh capabilities, the drill down (unless when you click on the charts it takes you to another more detailed chart),, and if possible, all references to the 'Splunk' brand (so it looks more like an internal app Management could use to showcase some stats to partners, etc). I have the dashboard, but Im looking how to do the other things. Thanks! M... ... View more

I have a request for something rather complex. I have a Web App behind a BigIP load balancer, I set the BigIP to send me the whole transaction to splunk as it happens. Im extracting already the fiels,, and I need the following: - As soon as one XML response comes back with certain combination of the two fields, I need to trigger a SOAP request, get the answer and display on splunk again. Can Splunk trigger a SOAP request based on a condition of values received as input? ... View more

Im trying to solve a problem with my regex. Im extracting the username from an XML transaction. Sometimes the username comes like this (Byt the way, I think I dont know how to post XML code on the SplunkBase because it gets processed by the editor, so Im omitin some ">" and "<" to get it out). <login>[email protected]</login> I can get it with this Regex: (?i)<login>(?P<CustomerName>[^<]+)" And sometimes like this: <login xmlns="">[email protected]</login> I can get it with this Regex: (?i) xmlns="">(?P<CustomerName>[^<]+) Im trying to get a Regex that satisfy both cases,, I was thinking about a boolean, like OR (||) between the two REGEX, but it didnt work. Im new to this and I dont know how to use it. Thanks!! ... View more