Note that the second search gives a different result, so you probably want to modify it. ... View more

Please clarify a bit: Is this on Windows? What kind of data are you trying to collect? Do you have a Splunk Universal Forwarder installed on the client system? ... View more

What you're looking for is covered mostly in the Distributed Search documentation: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration Here's a setup with a single search head and a single indexer: Install Splunk on each machine Indexer: Enable receiving Search Head: Enable forwarding of all data (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata) Search Head: Add the indexer as a search peer (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuredistributedsearch) Indexer: Configure as license slave to the Search Head (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurealicenseslave) You can also disable the ui on the indexer, to make sure that you always search from the search head. I also like setting up the search head as a deployment server, that deploys the configuration for the indexer. That way you get a single machine to find all the configuration on. Note that you will have to create indexes on the indexer, not via the search head UI. There is more info in the documentation on distributed search and what it means for administration of Splunk. ... View more

A simple test with Java 1.8 and openssl s_server using the same certificates from my Splunk system returns successfull connections. Just for clarification; this means you have your certs imported in the Java keystore that is used by the app as well, correct? ... View more

Since you're familiar with summary indexes: Acceleration is basically summary indexing with a different format. As all Splunk processes, it assumes that data is immutable. I think your solution is the only way to do this. ... View more

There's this app: Lookup File Editor App for Splunk Enterprise https://splunkbase.splunk.com/app/1724/ I haven't used it personally, though. There's also an example app in the Web Framework documentation that modifies KVStore lookups. ... View more

You are using the wrong Java version: 2015-06-11 10:29:31,685 ERROR Java process returned error code 1! Error: Exception in thread "main" java.lang.UnsupportedClassVersionError: com/splunk/bridge/JavaBridgeServer : Unsupported major.minor version 52.0 The error means that the Java Bridge is Java 8, and your JVM is not. If your're using DBConnect v1.2, it looks like you need Java 8 (although the app page says not): http://docs.splunk.com/Documentation/DBX/1.2.0/DeployDBX/Deploymentrequirements#Java_Runtime_Environment_.28JRE.29 ... View more

The sourcetype specifier is a type of regex, so you could make the field alias something like (sourcetype1)|(sourcetype2) , or if you truly want it to apply to all sourcetypes (probably not, except if you set the alias to only be shared in a specific app), it should work with e.g. * . Edit: Scratch that, it is not a regex for sourcetypes, see http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Propsconf <spec> can be: 1. <sourcetype>, the source type of an event. 2. host::<host>, where <host> is the host, or host-matching pattern, for an event. 3. source::<source>, where <source> is the source, or source-matching pattern, for an event. In that case I don't think there's a solution using aliases, unless your sourcetypes match your sources in some predictable way (in which case you can use wildcards in your fieldalias stanza). So in short, yes, you need to create an alias for each sourcetype if you want the same alias for different sourcetypes ... View more

Is this when indexing data, or when searching on already indexed data? It sounds like you are having problems getting the events to break correctly. Do you want to skip parts of the log files when indexing? ... View more

I'd avoid Real Time alerts for this, since each such alert is a real-time search that uses up a lot of CPU. Run it as Scheduled, every minute, instead. That's near-real-time enough for most email alerts. ... View more

The data in Splunk will stay even if you remove the files that you indexed. The only way to remove data from Splunk is to pipe the results from a search to the delete command (for a user that has the can_delete role). Or to remove the index itself. ... View more

The path /etc/apps/testing/local/datetime.xml looks like an absolute path from the filesystem root. Does changing it to etc/apps/testing/local/datetime.xml help? ... View more

An alternative for the subsearch, in case you are intending to compare the previous period with the chosen one, is to use the timewrap command provided by this app: https://splunkbase.splunk.com/app/1645/ You will still need to select the correct time period, though. Take a look at the examples here: http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/PanelreferenceforSimplifiedXML#input_.28time.29 ... View more

Follow-up question to this: Does this require running DBConnect on Windows? ... View more

Is it? What feature would be disabled in this case? ... View more

I believe the question is referring to disabling the management port on e,g. forwarders. The deployment clients are the ones sending requests to the deployment server - they don't need to have any open management port unless you want to do stuff like remotely run oneshot inputs. ... View more

What if you reference one of the fields you're expecting? Such as search index=_internal log_level=* | head . I know that saved searches have a behaviour where they will only run extractions on fields that are used in the search. ... View more

You should post this as a new question, or a comment, instead of an answer to the top question. But to answer your answer: You can create an alias (called a search macro in Splunk) for a search string in the GUI under Settings - Advanced Search - Search Macros. To use the macro once it's been created, you have to surround your macro with backticks, like this: myawesomemacro() . The parenthesis are best to include, since there are cases where they are required even if you have no arguments. As for span, you can use span=1d . Check the timechart search command help and you will find the span option along with some example usage. ... View more