Hi, at the moment I am using a Splunk 4.3 license server. Now I want to install Splunk 5 and before I install it, I want to know if Splunk 5 works with the Splunk 4.3 license server? Thank you BR ... View more

Hi there, today I have a special question. I am not sure how to realise this. I have on the one hand a lot of performance values, like 20, 13, 15. On the other hand I have the time stamps for those performance values. It mean, I can create easily a graph. No I am adding a extra line, called recommendation of 10. Now we have a graph and a line which is the treshold line. The idea is now, to calculate the area which is higher than the recommodation. I already found the mathematic phrase but I think there is maybe another way to realise this. With a mathematic phare it is so complex... Could you please advise me how I can realise this? Any kind of ideas are more than welcome. Thank you very much in advance Regards ... View more

Hi there, at the moment I am using a Deployment Server which is also the SearchHead. Forwarders were installed automaticly and they get a deploymentclient.conf file placed to /opt/splunk/etc/system/local (highest priority). Because of performance issues I plan to introduce a new Deployment Server. Now I am not sure how can I say to the existing Forwarders that there is a new Deployment Server to connect. The idea was to use the global app and in that app I would define the deploymentclient.conf with the new Deployment Server. I would placed that App on the old Deployment Server and after a phonehome the Forwarder gets the new configuration and connecting to the new Deployment Server. But there is one problem. I think the highest priority has /opt/splunk/etc/system/local and this configuration will override the configuration in the global app. So what can I do to change the Deployment Server by using the Deployment Server to change that configuration. Thank you in advance Regards ... View more

Hi, I'd like to use the top command in my search. The problem is, that the fields which I want to top can change if the sourcetype change. sourcetype=windows than top eventlog sourcetype=others than linux_messages My idea was the following sourcetype=windows | eval os = if(sourcetype="windows","eventlog","linux_messages") | top os With "top os" Splunk only displays "eventlog" (as logical). But "eventlog" is also a field. I want that Splunk replace the "top os" to "top eventlog". Is there a way to to this? Thank you ... View more

Hi, I think I have a quiet complicated request. Lets say I have the following event, which contains LDAP error for hostXYZ It is a real-time search configured which is triggering the words LDAP AND error. Now I want to check before the alert appear, if the hostXYZ is valid. So all hosts which generates the event with error and LDAP should checked against a lookup which contains a table if the host is valid. Thank you very much ... View more

Hi, I have a lot of forwarders. I want to make sure that the forwarders got the right app. I did some searches but could not find anything related to my request. Is there a Splunk search which shows a list with all forwarders and the installed app? Thanks ... View more

Hi, I want to create an alert for Forwarder which sending more than 2 GB / day. I already found this Community:TroubleshootingIndexedDataVolume I general it is the right way, but I have a special request which is not covered in Splunk Wiki. I want to count the log amount of hosts which are located in a specific sourcetype. In the example search I just see amount of sourcetype and amount of host. If I would use the host search, I would see all hosts, but I just want to have hosts from a specific sourcetype. Do you know how I can realize that? Thank you Regards ... View more

Hi there, is there a way to stop a Splunk Forwarder when its sending more then for instance 2 GB ? From a SearchHead I could configure an alert which appear if a Forwarder logs more than 2 GB. But after appearing the alert, is there a way to stop the Splunk Forwarder deamon via REST API or start a other script which can stop the Forwarder via Port 8089 ? The problem is I just can reach the known ports, I can not access via SSH to the Forwarders. Thank you Regards ... View more

Hi, lets say I have a drop down with "red" and "green". If I choose red the search should look like: index=red | top red_user If I chosse green the search should look like: index=green | top green_user Normally it is not a problem to use the token from the drop down in a search, but how can I handle it if the complete search should changing after choosing a field in the drop down? Thank you Regards ... View more