Hello, I have a distributed dev environment that matches very closely to our production environment. This is a very typical best practice no matter what software you're dealing with. I was shocked to find that the new 50Gb development license does not support being a remote license master for a distributed search environment. I guess I'll have to renew my 10gb dev license and use that instead. I'm really looking for an answer to whether this was intentional, or if a mistake has been made with the way the new licenses are issued. Regards, BPitts2 ... View more

Hello all, This morning I logged into our deployment server and found a message that the forwarder manager screen was in 'read only' mode because some of our serverclass.conf settings were not supported. Ok, not a big deal, right? I figured I would just browse the config, find the error and correct it. The error message that was thrown is below: 11-16-2015 12:08:18.789 -0500 WARN DS_DC_Common - Attribute unsupported by UI: stanza=serverClass:PerfmonManage property=restartSplunkd reason='2+ distinct values at this level' Well, the problem is that my D:\Program Files\Splunk\etc\system\local\serverclass.conf doesn't contain any stanza named "serverClass:PerfmonManage" Is there an easy way to figure out where Splunk has picked up "serverClass:PerfmonManage", maybe in another conf that I'm not thinking of? Thanks, BPitts2 ... View more

Hi all! I am just getting started with an environment that we've somewhat inherited from another team within our org. For a variety of reasons, we use Heavy Forwarders to aggregate and forward data out of our network segments. We've been wanting to use the Splunk app for Stream to capture SIP traffic from a few of our nodes. Today, I decided to try and figure out the installation plan, which has me very confused. First, I'm not sure whether the Splunk app for Stream needs to be installed on our Indexers, Heavy Forwarders, or our Deployment Server. (Btw, we use a stand-alone deployment server) Second, once Splunk app for Stream is installed, I know I'll need to deploy the Stream TA package to my Universal Forwarders. I've found that with the base configuration, just deploying the package with no modifications leads to my Universal Forwarders receiving an inputs.conf such as the following: [streamfwd://streamfwd] splunk_stream_app_location = https://DeploymentServerAddress:8000/en-us/custom/splunk_app_stream/ stream_forwarder_id = disabled = 0 I assume, that this isn't what I want. Or maybe it is. Is this address just used as the management node for the stream app? (For example, protocol configuration?) I was figuring that I should have the Splunk app for Stream installed on my Heavy Forwarder, and as such, have the inputs.conf directed like: [streamfwd://streamfwd] splunk_stream_app_location = https://HeavyForwarderAddress:8000/en-us/custom/splunk_app_stream/ stream_forwarder_id = disabled = 0 Additional questions: If my assumptions are correct - Under data inputs, does streamfwd need to be enabled on the Heavy Forwarder? In the inputs.conf, under streamfwd can I specify which Index I would like the data in? Picture for reference: ... View more

We have a system that stores very valuable data into a SQL database. I'd rather not ingest the entire DB (because it's huge). I'm wondering what strategy I should go with to get just the results of a specific query. Let's say for example I want to index the the results of something like: SELECT Count(*) FROM sample_table WHERE date > '2015-10-03 00:00:00' I'd like to do this on an hourly interval. So I was thinking, I could write a script using sqlcmd such as: sqlcmd -S theServer-d thisDB -E -Q "SELECT Count(*) FROM sample_table WHERE date > '2015-10-03 00:00:00'" -o "SQLOut.txt" Then I would setup a monitor on that file. Is there a less rube goldberg way of doing this, maybe using DB Connect 2? Thanks in advance! ... View more