This is a poor workaround and results in errors in the btool.log for one.  This needs a better supported solution for checking deployment apps before they are pushed out (or after). /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps-symlink --debug | grep Splunk_TA_windows Even with or without the symlink to 'system' under this new deployment-apps-symlink, there are btool errors about spec files either not being present, or being in the incorrect place as per.     ... View more

I have tried all these too and cannot seem to get deployment server apps checked. the btool output is simply silent. ... View more

Some years later and this is still the case. Neither inputs.conf, server.conf, or deploymentclient.conf will change the 'Host Name' for the forwarder under mangement of the Deployment Server. It may take some environment variable or startup variable to change this. I am not sure. Sad this is so difficult and should be far easier. (IMHO Splunk puts far too much on their customers and now cutting support for non-paid apps means even MORE is put on the customers. I bet it comes back to bite them soon.) ... View more

Driany, Are you guys talking about the "Splunk App for Microsoft Exchange"? https://splunkbase.splunk.com/app/1660/ On the comment about it being free: It appears as a paid app and I was wondering about that: "This app requires a paid license to use. The trial license lasts for 60 days." Or maybe i'm just confused and it implies the splunk server itself is a licensed product? I am also digging into the docs to see how if works on a distributed exchange install : http://docs.splunk.com/Documentation/MSExchange/3.1.3/DeployMSX/Releasenotes http://docs.splunk.com/Documentation/MSExchange/3.1.3/DeployMSX/AboutSplunkforMicrosoftExchange http://www.splunk.com/content/dam/splunk2/pdfs/solution-guides/splunk-for-windows.pdf ... View more

You can also check inbound EventsPerSecond or Kbps similarly: index=_internal "group=thruput" host=myhosts* | timechart avg(instantaneous_eps) by host span=1m or index=_internal "group=thruput" host=myhosts* | timechart avg(instantaneous_kbps) by host span=1m naturally you'd check these in a real-time or short window if you are looking for what is happening at that minute. ... View more

Try seeing if your are getting intputs from the host you are expecting in the _internal index on your indexer in search: index=_internal host=windowsserver01 If the indexer has data from that host I believe it would show up there. ... View more

It would be a lot better inline. I tried but as such in our 6.1.2 server cannot it does not work. ie. | stats round(avg(duration),0) ... View more