Hi, as described in the manual to configure the DMC, I have installed it now on a master node. The deployment looks like: 5 Clustered Indexers 1 Cluster Master 2 Search Heads 1 Deployment Server All non-Indexers sent their data to the Indexers as recommended. So far everything works as expected, unfortunately within the DMC config the Master Node features the roles of "Cluster Master, Indexer, License Master and Search Head". Therefore, the server itself is shown in panels only meant for real Search Heads, Indexers of License Masters. Is there a way to disable the roles of Indexer, License Master and Search Head on the Master Node? I'm still surprised some of them are even mentioned as e.g. the Master Node is a License Slave to a Search Head which is also the License Master. ... View more

Hi, we upgraded our Splunk 5.0.9 Test-Cluster to 6.1.3 today (two indexers, one cluster master, one search head) and followed all instructions from docs.splunk.com. All Splunk instances are running on seperate servers on W2K8 R2 SP1 as OS. After the upgrade Indexers and Cluster Master have problems connecting to the Search Head using port 8089. Example from an Indexer (x.x.x.x is the IP of the Search Head): 08-07-2014 17:15:22.058 +0000 INFO NetUtils - Error in connection() 10060 08-07-2014 17:15:22.058 +0000 WARN HTTPClient - SocketError connecting to=x.x.x.x:8089 08-07-2014 17:15:22.058 +0000 WARN HTTPClient - Connect to=x.x.x.x:8089 timed out; exceeded 30sec 08-07-2014 17:15:22.058 +0000 ERROR LMTracker - failed to send rows, reason='Unable to connect to remote peer: https://x.x.x.x:8089 rc=2' Cluster is in sync and searching using the search head works so I could confirm that those errors were not present before the upgrade and only appeared afterwards. Port 8089 is open in the network and allowed locally in the firewall rules. Rebooting servers completely also didn't help. Did something change in 6.1.3 so that those errors are now present? What can I do to solve them? ... View more

Hi, I'm currently testing Splunk 6.0.1 on a Windows Server 2008 R2 (fresh install). I want to monitor that particular Windows-Server, so I downloaded the Windows App 5.0.2 and installed it via the GUI. Now during the initial setup of the app, I just clicked "Save" without modifications to any parameters. Under "Windows Perfmon Inputs", all options were listed under "enabled": Processor, Network Interface, Memory, PhysicalDisk, LogicalDisk, Process, System. However, after saving the settings, the dashboard "Performance Monitoring" in the app showed no data. I troubleshooted a bit I found that under the settings page in the app, all Perfom-Inputs were gone except for "System". They weren't shown under "enabled" nor under "disabled". I don't understand why this happens. I tried to configure the inputs manually in inputs.conf (didn't work) and also tried installing a separate Universal Forwarder with the Windows TA, but that instance also wasn't able to send Perfmon-data to the Splunk-Instance. Anyone has an idea what's going on here? Thanks, Leo ... View more

Hi, I'd like to use Splunk itself to to generate a .csv-lookupfile to enrich one of my data sources. The data for this lookup comes from an XML-file that is undergoing several changes per week. Now I want to automate this as good as possible and thought about the following solution: a) Configure Splunk to monitor a folder in which I'd copy the new XML-file once it has undergone one or more changes. The sourcetype for that file is configured to see every line of that XML-file as a new event. b) Use a schedules saved search (I already finished the searchstring) to filter down and process the events from the XML-file and generate a new lookupfile (overwrite the old one) with the | outputlookup-command. My problem is that I somehow have to differentiate in the scheduled search to only use the newest data from the XML-file. Let's say I'd run a scheduled search every day for the last 24 hours and there was no new XML-file uploaded - outputlook would overwrite the .csv-file with an empty one. And in case I'd upload two new XML files per day, I'd end up with an .csv-file having double entries. Someone has an idea how to solve this problem? Regards, Leo ... View more

Hi, I have evaluated a field count with value 10000. Then I converted it with fieldformat to include a thousand separator to display it on a single value panel. Now I want to replace the comma with a dot, because we are in Europe. How can I do that? I already tried this: searchstring | stats count | fieldformat count=tostring(count, "commas") | rex field=count mode=sed "s/\,/./g" The result makes no difference - it's still as if I didn't use the rex-command. Thanks, Leo ... View more