Question: would publishing a version that doesn't allow monitoring HTTP sites (only HTTPS) work for you? I have considered making a cloud-only version of Website Monitoring but I figured that most people wouldn't bother using it if you couldn't monitor non-SSL websites. Let me know; I would be willing to consider making a cloud-only version. ... View more

Some good news. I was able to edit my single value searches my dragging the window bottom-to-top to reduce it's size and resaving. Now both fonts and value size are closer to normal. ... View more

I agree with your points. Question is, why to create separate apps when there is only one Search Head (that is combined with Deployment Server) and two indexers? Having a single deployment app will make it much easier to manage and deploy the app. After all, all this belong to the same app, so having multiple installs for the same app and all of which will be installed on the same box, is sort of counter intuitive. ... View more

problem again: Java Bridge in running while trying to add a database input i got the error: Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/admin/dbx/dbx/databases: The read operation timed out',) Thanks ... View more

Doesnt look exactly like what you're looking for but if taken to a pivot this could be done: index="summary" source="a.txt" |rex field=_raw "(?<service_number>(?<=Service).*(?==[1|0] ))" |rex field=_raw "(?<running>(?<=Service..=)([0|1]))" |eval running=if(running==1,"Running","Stopped) |eval serviceName=if(match(service_number,"\d1"),"Service 1",if(match(service_number,"\d2"),"Service 2",if(match(service_number,"\d3"),"Service 3",if(match(service_number,"\d4"),"Service 4",if(match(service_number,"\d5"),"Service 5","n/a"))))) |stats first(running) as Status by serviceName, host ... View more

Regarding your original question: 2 indexers => yes. 2 servers => no. Single-site clustering would be the best approach for you, only then splunk can take over the replication part. But not with only 2 servers. You need at least 4 instances (two peers, one master node, one search head). Load balancing only helps for availability if server-1 goes down, but that doesn't mean your data are in sync. You can set up an rsync job to keep warm and cold in sync (warm/cold buckets are read-only for splunk), but not hot buckets. Well, you can limit the retention or size in hot to not loose too many data if server-1 fails. If your hardware is performing enough you can set up different instances for different roles on the same machine using different IPs. Different ports is not enough. But this is fiddly and totally not supported. And seriously: Why not creating the master node and search head virtual? Or the whole thing virtual? ... View more

I think this is exactly what I am looking for. I will work on it and keep this thread updated. Update: This is it 🙂 ... View more

I see this listed as error in 6.2 splunkd.log ... View more