MV_ADD = [true|false] * NOTE: This attribute is only valid for search-time field extractions. Thus, you need to use REPORT- not TRANSFORMS- ... View more

Hi, It is not as easy as changing something in inputs.conf. While you can specify under any input stanza something like index=test, which will then route any events received on that input to index=test, in your case you only have one input (udp:514) for two data-sources so you'll need a different method. (As an aside, the inputs.conf you posted does not contain the udp 514 listener. There must be another inputs.conf, somewhere in $SPLUNK_HOME/etc/apps//local - likely in $SPLUNK_HOME/etc/apps/launcher/local. These get merged at run-time by Splunk. It's like this so apps and add-ons can supply their own inputs.) Here are a few options, in order of level of effort: 1) Configure either Aruba or Checkpoint to send syslog to a different port. Create two inputs and set the index per input. 2) Use Splunk props.conf and transforms.conf configuration files to set the index per-event. It is very similar to the example here: http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Advancedsourcetypeoverrides, however you are updating a different DEST_KEY. You can also reference http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Setupmultipleindexes#Route_specific_events_to_a_different_index 3) The best practice for syslog is to setup a separate syslog server (or even a syslog process directly on the Splunk indexer, if your environment is small) instead of sending directly to a Splunk network input. You can just google "Splunk syslog server" and you'll see why and how. For instance: https://answers.splunk.com/answers/28680/universal-forwarder-vs-dedicated-rsyslog-syslog-ng-servers-to-forward-syslog-to-splunk-indexer.html. You then use syslog to split Aruba hosts and Checkpoint hosts into separate files, and then Splunk reads each file as an individual input with it's own index specification. While this is more complexity and requires you to learn syslog, it is really the most robust solution. Good luck! ... View more

Splunk's datastore is a poor place to synchronously replicate the state of a database table. That's because once an event is indexed in Splunk it cannot be updated. One possible solution is to take snapshots of the table using a batch input. You can then refer to the relevant snapshot in your searches. If it's just the most recent snapshot you need, consider the lookup or query functions of DB Connect to access the current state of the table. Can you explain what you're trying to do at a little higher level? ... View more

What is sufficient to pass through #2? Will the Cluster Master wait for the replication factor to be met before sending an ACK to the forwarder? What about the search factor? Consider a multi-site replication environment and the scenario where one site is down. The replication factor won't be met during the outage, and thus the forwarder will not receive an ACK and will stop forwarding data. So in a DR scenario, you won't get real-time data. Is that correct? ... View more

Your user may not be configured to search index=f5 by default. You can fix this by going to the roles settings and adding F5 to the list of indexes searched by default. Also, you can ignore the "search" text at the beginning of the query. The inspector is somewhat confusingly giving you the verbose version of the query that is sent to the indexers. search is the SPL command that is implicit when you type something in the UI search bar. You might be interested to know that search is not the only command you can use to generate results, for instance you can try searching for "| dbinspect".,Ignore the "search" that you are seeing in inspector. When you do a search in the UI search bar, that is the SPL command that is being called behind the scenes. The inspector somewhat confusingly is including the full verbose API call being sent to the indexers. (FYI there are other commands you can use to start your query, for instance | metadata). Anyway, by default your user profile may not be searching index=f5. You can see this in the roles setting. Just add F5 to the list of indexes that are searched by default. Hope that helps! ... View more

Also don't forget to run sudo ./setuid from the Splunk_TA_Stream directory. ... View more

| bucket Update_Time span=2m | stats count by Update_Time ... View more

You can't currently have multiple key values for the update to occur on. This is one of the things we might add when we make dboutput GA. ... View more

This looks like the Java Bridge started up successfully. Where are you seeing it in a "loading" state? It is normal to have multiple Execution sessions. What do you see when you go to the status page here: http://localhost:8000/en-US/app/dbx/dbxstatus ... View more

dboutput.conf is not supported in all versions of DB Connect 1.x. Trying to invoke | dboutput <stanza name> will throw a NotImplementedException. If you want to manually generate the sql, you can either set sql , or sql.insert and sql.update . Make sure to also set advanced=true . For the sql syntax, one hint is to look at what the debug logging shows about the auto-generated query. For an example, see: http://splunk-base.splunk.com/answers/88599/dboutput-bug-updating-mysql UPDATE mytable SET ip=$ip$, NetAddress=$NetAddress$, ComputerName=$ComputerName$, Manufacturer=$Manufacturer$, Model=$Model$, mac=$mac$, IPAddress=$IPAddress$ WHERE ip = $ip$ So in your SQL you can reference any field in the search results by using $fieldname$. To invoke the config is fairly simple, just use | dboutput <stanza name> ... View more

DBConnect will only convert one timestamp per event - whichever you choose as the time the event itself occurred. All other fields will not be converted before indexing. You can convert at search time by using the convert search command. ... View more

What did you do to lead up to this error? Clean install? Did you happen to reinstall Splunk, or copy configs over leading up to this? ... View more

What is the data type of PROCESS_ID in the database? You can see this from Splunk by using dbinfo ... View more

I'm the owner of DB Connect. Try turning on debug logging (http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/javaspec) and see what SQL actually gets executed on drilldown. ... View more

Lets check one more thing. Sometimes changes in the manager UI create duplicate configuration files in different app contexts, and these configs can conflict. The fastest way to check this is to use the command line: $SPLUNK_HOME/bin/splunk cmd btool --debug-print=app inputs list | grep dbmon-tail Output should look like: dbx [dbmon-tail://cmdb/cmdb_audit_log] search [dbmon-tail://cmdb/cmdb_audit_log] Check the output for duplicate entries like in the above. ... View more

Perhaps your rising column does not increment in an orderly way. Looks like in the table there is a row with process_id 99999. Do the most recent entries have process_id higher than that, or lower than that? You might consider using end_dt as the rising column ... View more

Can you post your dbmon-tail stanza and your state.xml file, which is in $SPLUNK_DB/persistentstorage/dbx. Each input has it's own directory, which is a hash of it's name (ie. a 32 character long hex string). This directory typically contains 2 files: manifest.properties: contains meta-information, such as the name of the input state.xml: contains the actual state in XML format This state file looks something like this: 2012-12-07 04:22:25.703 ... View more

Yes. It's Splunk Supported and widely used, with over 5K downloads since it was released in November. Why do you ask? ... View more