This always goes back to the base of the "current" app, not the Unix app specifically. ... View more

join kind of works, but is much less efficient than using a subsearch with a return in most cases. You are already using a subsearch in one of your searches. It's okay to have a subsearch within a subsearch. Something that should work for you would be: sourcetype=web_threat dst_hostname="badsite.com" [ sourcetype=dhcpsrvlog description=Assign OR description=Renew [ inputlookup hostwatchlist] | dedup dest_host | return 10000 src_ip=dest_ip ] return 10000 says to query for up to 10000 results from the subsearch (this is the max), and src_ip=dest_ip says to use the value of dest_ip as src_ip in the outer search. This does lose you the dest_host , but you could recover that by adding a | lookup hostwatchlist dest_ip AS src_ip OUTPUT dest_host AS src_host (which also renames dest_host to src_host , which makes more sense in this context. So: sourcetype=web_threat dst_hostname="badsite.com" [ sourcetype=dhcpsrvlog description=Assign OR description=Renew [ inputlookup hostwatchlist] | dedup dest_host | return 10000 src_ip=dest_ip ] | lookup hostwatchlist dest_ip AS src_ip OUTPUT dest_host AS src_host However, this will lose you the "type of lease", and you can't get that back as easily. If you need it, then a join will do it, or you should do it in two steps by writing the first results to a lookup. ... View more

It might be easier to use this app by David Carasso, Timewrap. https://apps.splunk.com/app/1645/ ... View more

Your input port on the receiver needs to be defined as "splunktcp" not "tcp". ... View more

you need to edit the search, not the time selector. ... View more

Seems like you should just be able to increase the number you're comparing against age , e.g., to 86400 x 28. I suppose if you want to every day report on every host that has ever stopped sending, then you can just remove that filter entirely. ... View more

One other way you can consider (but which is not completely secure -- a clever user with the right access could get around it) is to use the role filters. Set up roles for each client X, then set up roles with the filter client_id=X for each client. Separate indexes will be more secure, but role filters will work similarly in most cases. ... View more

You can also (if you want) try something like: ... | addinfo | eval diff= info_max_time - _time | bucket span=1log10 diff | chart count by diff You can experiment with different values for the span, e.g., 1log2 or 1.2log10 . This will give you time differences in seconds. The number of seconds might be awkward to work with though, so the method above with case() would be better in that case. ... View more

after enabling boot-start with -user , you should not use splunk start to start splunk. Instead, you need to use service splunk start . The boot-start installs a startup service that runs as the non-root user. There is no -user option on splunk start . ... View more

I will add that you should also expect to use additional temp space in the dispatch directory, the place where intermediate search results are stored. One feature of SHC is to create replicas of search results (from jobs, etc) so that results can be available even if a node fails. In practice, most people will have enough excess space, but a few will find that they are running pretty tight and may need to increase. ... View more

http://blogs.splunk.com/2014/09/24/finding-shellshock-cve-2014-6271-with-splunk-forwarders/ ... View more

5.0.4 is not a current maintenance release, and will certainly have vulnerabilities that are not in the current 5.0.x maintenance release. For example, 5.0.4 is still vulnerable to Heartbleed. ... View more

It technically will probably work fine. However, 4.x forwarders are no longer supported by Splunk. At the time of release of 6.0 (a year ago), there was a grace period where version 4.x software was still supported, but that grace period has expired. Therefore there is no guarantee that it will work and if it does not, your recourse will be to upgrade the forwarder. ... View more

edited to fix. seems the <code> tags don't work as well as the backtick ` for code. ... View more

This Updog sounds interesting, but most of the information I've found only talks around what you can do with it, but not what it fundamentally is. ... View more

Actually you probably want String search = "search samplesearchstring" . You generally don't want to search _raw=xyz , because that will only match if the entire raw string is xyz . The general point is that the first word of the search is the command you want, and then it's followed by the arguments. Most of the time you just want search , but it's possible to use others, such as metadata or inputlookup . ... View more

Of course a forwarder must consume some resources on any system it is monitoring. We have worked hard to make sure that it's footprint is minimal. A UF when monitoring a reasonable set of log files (or Event Logs) typically will use less than 1% of a CPU and maybe 30 MB of memory. This amount can be higher if you, for example: monitor many tens of thousands of files with many changing files; increase the thruput limit on the forwarder; install addons that consume additional CPU or memory to collect other types of data sources. ... View more

Yes. You can find out more details as well as other tools (Eclipse plug-ins, examples, etc) starting here: http://dev.splunk.com/view/java-sdk/SP-CAAAECN And more directly here: http://dev.splunk.com/view/java-sdk/SP-CAAAEJ2 ... View more