Anybody find a solution to this? I'm seeing this over lots of indexers! ERROR EAIOutParameters - invalid entry title in toAtom(): INDEXER_MISSING_INDEX-_internal\x04\x12evt_resolve_ad ... View more

What is the default for thruput as it's not specified? [thruput] maxKBps = <integer> If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second. To control the CPU load while indexing, use this to throttle the number of events this indexer processes to the rate (in KBps) you specify. What queue size increases are recommended for a busy Windows Universal Forwarder? Shat is the negative impact of having big queues? ... View more

title says it all? does not state clearly in docs like other files such as inputs.conf ... View more

I'm trying to add this to my search but the number of lookup users may change!! (|inputlookup lotsofusers.csv | return 3 $users) ((user1) OR (user2) OR (user3)) Is there a better way to do this? * does not work. Thanks ... View more

This search produces the most recent timestamp for every host for aa specific index | metadata type=hosts index=windows | convert ctime(*Time) | table host index recentTime how can i break it down a level further by last tinme a host reported in for a given sourcetype and index? eg host index sourcetype recenttime host1 windows system 30/06/2014 04:55 host1 windows security 30/06/2014 05:15 ... View more

so i just want to clarify somethings: app deployed: test_app directories: Default, Local Default: inputs.conf Local: no files what happens if i make the following changes to the app on the client: 1)modify the file in default -> test_app/default/inputs.conf Will changes be ovewritten? 2)create a file in local -> test_app/local/inputs.conf Will changes be ovewritten, ie file deleted? 3)create a new file in default -> test_app/default/props.conf Will changes be ovewritten, ie file deleted?* IF there was some config in the local directory on th Deployment server ie Local: savedseraches.conf 4) would the config in local even get deployed? 5) modify the deployed file in local -> test_app/default/savedseraches.conf Will changes be ovewritten by orginal savedsearcjes.conf on the DS? *OR* Are no changes overwritten until the app and therefore hash is changed on DS itself?! if it is will that overwrite local? Can someone clear this up? Thanks!! ... View more

How can i determine if an app has ever been managed or is being managed? I added a deploymentclient.conf to a dev HWF server and created serverclass etc on DS with only one test app. The deployment server only had one test app to push out and i assumed none of the other apps have ever been managed. They have definitely not been managed by this DS. Anyhow, the Deployment server deleted about 20 apps....!!!! I presume they were managed for a short time by someone else doing some testing, a long time ago?! How can i found out if the apps have a history of being managed!? is there a log file or conf file somewhere? there must be! http://docs.splunk.com/Documentation/Splunk/4.3.6/Deploy/Updateconfigurations#App_management_issues 😞 NOBODY KNOWS!!?? ... View more

We have many different data sources which can only send on 514 UDP. I need to define the sourcetype based on the host value. I can see this can be done easily using a regex as described here Advancedsourcetypeoverrides However we have thousands of hosts with no obvious naming conventions. so what i would want to do is maintain a list of hostnames and refernce that and say if in ListA; sourcetype=typeA if in ListB; sourcetype=typeB etc i really dont want to have several huge regex like host1|host2|host3|host4|.................|host230|host231.... there is also no easy way to to regex based on the pattern of the events! any ideas?! ... View more

when i run the follwing search on licnece manager - detail per indexer (slave): index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by i useother=false The values are given for each "i" Each "i" has a value that looks like: "113E57F6-005D-4CE9-8AA7-97A5F03C2C9A" How can i convert this to a hostname? i thought if i look on a SH and look at the Search peers configure it shows a licnece signature that looks like : "af4d92d37b1c42ad49719d49e0ab0c28 " Unfortunately these do not tally up at all! Please help! ( note the LM is running 4.2.4, indexers are 4.3.1) ... View more

How do you specify the domain(ldap strategy) of the account you are logging into when you have mutliple LDAP strategies? eg. you have 2 matching named accounts mappeed to roles as part of various groups in different domain/ldap strategies. LdapstrategyA\jbloggs1 LdapstrategyB\jbloggs1 From the login prompt it will not let you use the Domain\account convention You can login with USERNAME: jbloggs1 but the follwing produces error: USERNAME: LdapstrategyA\jbloggs1 What will happen when two LDAP starategies have a matchng username? Does this use the Connection Order? if password fails for the first account it finds will it continue to the other ldap strategies to look for another account? ... View more