So.. are you calling the following search using the splunk console or api? Both you should be able to pass the credentials, for example: ./splunk search 'index=_internal | fields _time | head 1 ' -auth 'admin:secret123' ... View more

Another thing.. in your Regexp, you have a "." (dot) at the end... is that really there? You might wanna remove it. ... View more

Ok, so if you're running Universal Forwarders it need to be done at Master. Have a look on that link, try to replicate that example and once work adjust for your needs. ... View more

Have a look on this link: http://answers.splunk.com/answers/96/how-do-i-exclude-some-events-from-being-indexed-by-splunk.html Also, are you doing that only on your master? You might need to configure every forwarder. ... View more

Wouldn't be better to instead of editing the file, simply replace with a new version? Or at least a couple of standard versions of this file? If you have that big number of server, an orchestration tool might help as well 😉 ... View more

Interesting, it might be a bug on the release, works over here... anyway, sticky with fillnull for now. Cheers ... View more

You are confusing thing, let's try to clarify: STATS when using stats by , the stats will only group things by the selected field, if the field is present. FILLNULL The fillnull command creates value for fields that don't exist on the event, by default it populates with "0", but you can speficy any value. Now, if you look your searches, the first thing I noticed is the lookup command. Looks like you're using the CSV file instead of the lookup definition, that's the reason why the "Default Value" from the lookup definition is not been used. Well, ignoring that and focusing on the fillnull only, at the second command, you're grouping by "value2replacelookup_RHS_2takenOut_CatchThis", but your fillnull is populating "value2replacelookup". Try update it like that: index=_internal sourcetype="splunk_web_access" | lookup ABasicLookupFoSplunkOnMyMachine_2takenOutButCatchThis.csv value2lookup | fillnull value="Not Resolved" value2replacelookup_RHS_2takenOut_CatchThis | stats values(status) by value2replacelookup_RHS_2takenOut_CatchThis ... View more

Sorry, I don't get where is the lookup command on your search... you need to try something like: index=_internal sourcetype="splunk_web_access" | lookup MY_LOOKUP status | stats count by msg Now the MY_LOOKUP is the definition name you created using a CSV file like: status,msg 200,OK 404,NOT_FOUND An alternative if that isn't working is just use fillnull , like that: index=_internal sourcetype="splunk_web_access" | lookup MY_LOOKUP status | fillnull value="Not Resolved" msg | stats count by msg This should populate all events without the msg field with "Not Resolved" ... View more

Paste here the full search command you're using... ... View more

You should go to "Settings -> Lookups" and click over "Lookup Definitions". It sounds that you already uploaded the CSV file, so just need to create a new definition. Give it a name, select the uploaded file and click "Advanced Options". There you should define, for example, minimum: 1, maximum: 1 and default matches: "CAT Undefined". basically Splunk will use this value to populate everything without a match on your CSV file. Remember now to use you Lookup Definition once you use the lookup command, and not the CSV file. ... View more

You might wanna look to a proper monitoring tool, like Nagios or any other which is capable of running synthetic transactions. In your case the synthetic transaction could be simply accessing an URL hosted on this Apache. I often see people using Splunk to perform application monitoring, where, from my point of view is a poor choice as Splunk is not designed for that. Anyway, you could try an App like this: https://apps.splunk.com/app/1493/, but for serious stuff, I recommend a "real" monitoring tool. ... View more

Yes, once you create your lookup definition you should define the "Default matches" to "Cat_Undefined", that will be the default value. Alternatively, you could use the fillnull command after the lookup. ... View more

There will be always the need to additional packages if you developed custom search/lookup scripts. I would prefer Splunk to ship the Python source/dev packages + virtualenv so would be easier to just run pip install PKG_NAME 🙂 ... View more

Hmm could pls provide more details/example? ... View more

The best approach might writing a custom lookup script, where you enter the HEX, and using a Python script returns the BIN as a string. If you look the example "external_lookup.py" inside $SPLUNK_HOME/etc/system/bin, you can see the main looping there, you could use the binascii Python library to easily convert. Cheers ... View more

The problem doesn't seems to be the DB Connect, it seems to be your Postgres instance that is not configured to accept connections from your Splunk Heavy Fwd host. Have a look on the pg_hba.conf file and some documentation, is quite straight forward to understand it, you basically define a source IP/netmask, db and the authentication method allowed. It works like a application firewall to prevent unauthorized access. You might need to restart/reload the Postgres after update the pg_hba.conf Cheers ... View more

Yes, it can. Have a look on the dashboard drill down feature, but is not very difficult to create that. The Splunk Dashboard Examples app has some similar cases can have a look. ... View more

Ok, if you receive via e-mail you'll need to manually (or create a script) to get the file out from there. Once you save it on your computer, just try the command: $SPLUNK_HOME/bin/splunk add oneshot yourfile.csv -index yourindex -sourcetype csv -hostname yourmachine.yourdomain -auth "admin:changeme" It should replicate the same process as uploading the file using the GUI. If that works you should be able to configure the command to run via Crontab every day. ps.: 13 Mb is very small and shouldn't be a problem loading it every day. ... View more

How big is this file? My first approach would be importing the whole file every day, using, lets say a crontab to call the "one shot" method. In Splunk you would have the historical changes, a snapshot per day. You should be able to easily plot timecharts, or simply create a view for the last imported data. ... View more

is this file incremental? Like, is only adding new data to the end of it? Or things might change everywhere? ... View more

If you're using everything as standard in Splunk, it should automatically index the events using the "11 Mar 2015 17:22:49,539" bit of your Logs and assume the date is in the local timezone as well. To search for a specific period you could use the "Time Selection", that is just at the end of the search field and before the magnifier glass icon. Just go there and you'll see many options to filter the time. An alternative method is to use time search modifier, which you specify as part of the search command... have a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/SearchTimeModifiers For simple things the Time Selection is easier... Cheers, ... View more

Have a look on this App: https://apps.splunk.com/app/1546 It's more to use external APIs as INPUT, but if you really need to call a REST API form the search, you might need to write a custom search command for that. ... View more

Have a look on this link: http://answers.splunk.com/answers/7164/how-do-i-set-up-ssl-forwarding-with-new-self-signed-certificates-and-authentication.html You might need to adjust a couple of things as this refer to an older Splunk version. Another option is to use firewall (even a local firewall) to simply block unauthorized connections to the Splunk input ports. Cheers, ... View more