Use LDAP port 3268 (Global catalog) or the SSL enabled equivalent. You may have to trim your user DN search path or add additional search paths to find the users. ... View more

I ran into inconsistent behavior with 4.2.2 when the indexers had an old copy of a lookup table defined and referenced. The search head had the updated copy. It was a bit of a pain to troubleshoot. The difference ended up becoming apparent if the lookup was applied after the main search results instead of fueling the main search itself. ... View more

Do you use multiple search heads? Maybe they are load-balanced? Also, could you be searching in different views? I think this might be user metadata that is saved on a per view (page) basis. Sometimes it is easy to search with the flashtimeline in the search app and also search in another app with a similar page. ... View more

A cleaner method may be using [host:*] stanza header. ... View more

What are the intricacies for a script based lookup in a distributed environment? For example, dnslookup. ... View more

How did you verify the checkin interval? ... View more

I will try. ... View more

I can use the same syntax to override the setting in system/local/deploymentclient.conf and it works as expected. but in apps/foo/local/deploymentclient.conf , it still shows up as desired when i type "splunk show config -name deploymentclient", but the checkins continue at 60 second intervals. ... View more

I am having trouble getting this setting to implement. Using a universal forwarder on windows the default checkin seems to be 60 seconds. I tried to specify 5 minutes in /apps/foo/local/deploymentclient.conf , but it still checks in every 60 seconds. Do you know if this must be set in system/local/deploymentclient.conf , or is it expected to work if specified in any /etc/app/ directory? ... View more

Actually, splunk upgrade doesn't auto-start splunk as root. After running sudo rpm -U splunk-4.2.2...rpm Then start splunk as the splunk user like this sudo su - splunk -c "splunk start --answer-yes --accept-license --no-prompt" ... View more

You also may want to "chown -R splunk:splunk /opt/splunk" while the system is down. ... View more

I found the related problem that was causing a problem. The file i was collecting from did not update the file modified time. For some reason MAX_DAYS_HENCE=2 props.conf default setting was comparing the timestamp against the file-modified time and not the indexing time. I was expecting MAX_DAYS_HENCE= value to apply to the current indexing time and the parsed timestamp... not the file modified time vs the parsed timestamp. ... View more

It was applied on the indexers. I still get inconsistent timestamp extractions. I am deploying universal Forwarder soon, maybe it will help with consistency. ... View more

Dude. Awesome format. Rock! ... View more

In my case, we have about 1600 actively written files for a syslog archive. About 30GB / day to disk. I think it may be considered a "bad" practice, but i avoid the extra disk read IO and CPU overhead by sending that data to splunk in a single TCP syslog pipe. I use a transform to extract host from the standard message itself. I use other transforms to assign sourcetypes as needed. I think there are two main caveats with this approach. You lose ability to auto-sourcetype by individual file source (for syslog sources) If splunk goes down or restarts, you only have as much buffer as your syslog forwarder can handle. This may be no buffer or a queue in RAM or other auto-handled spooling conventions. I don't mind assigning sourcetypes as needed because i got tired of the cryptic and inconsistent auto-sourcetype names for sources that had low log volumes. We still collect non-syslog files too. And also in my environment, nobody cries if we miss a few events here or there. I hope this answer also helps someone. ... View more

Another logout and clearing off all cookies in the browser and "site preferences" in firefox cleared up the issue. it is strange how this affected multiple users, though. ... View more

Unfortunately, it doesn't seem to be adding the correct date. Maybe i should add that these dns.log files are bing picked up by a windows light forwarder running version 4.1.6. Half of the timestamps are parsed correctly, the other half aren't. I like your answer though. I really think it is the right answer. Maybe i have a different question i should ask. ... View more

Maybe use this "registered executable" feature to call out a syslog command line logger. http://www.youtube.com/watch?v=XykFT1_8N4k Set up your data in key={value} format for easy analysis. ... View more