Thanks for the information Your right it seem to be my fault i didn't check first the version before upgrading it. Thanks Cris ... View more

Thank you ... View more

We have created an alternate option where you can analyze checkpoint logs via syslog. This add-on will help you analyze Check Point logs on Windows. https://splunkbase.splunk.com/app/2996/ I will be very happy to help anyone who is facing any issue with this Add-On. Thanks ... View more

Although I would add "why do you need to specify this?" Splunk is remarkably good at figuring out timestamps and this one is not hard. Splunk really shouldn't need you to specify anything - it can automatically handle this! ... View more

Thank you. hmm this one is tough for me for a newbie... maybe i need to read it first. btw this is my case i have a search to create a .csv format after that i need to send the .csv file via script. ... View more

Usually you don't read directly the WindowsEventLogs, and use the special inputs that calls the windows system API. However if you have evt files exported (not locked or touched by windows), you can to monitor them as regular files : please apply the correct sourcetype based on the actual log type ( by example WinEventLog:Application) see http://splunk-base.splunk.com/answers/37343/sourcetype-for-windows-event-logs please import the log file on the same OS version in order to translate them correctly see http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata#Index_exported_event_log_.28.evt_or_.evtx.29_files ... View more

Hi again Ayn can i create a conf file? for output.conf and the other instead? it will work if i do that? Thanks and Regards Cris ... View more

@ Sowings Thanks for the reply and into your time Is this the same with distributed search located at manager tab? Because my current set-up is I set this set-up using distributed search located at mangers tab Search Head Server search peer i add the 5 indexing servers xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Summary Indexing Server Summary indexing Server Also i add a search peer xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server xx.xxx.xxx.xx:8089 Indexer Server And now i need to save a search and enable it the summary indexing and choose my created sample index and set schedule and save it using summary indexing server after a hour to check if the date already save with my created sample indexes the search head server will do that using this search string ( splunk_server=* index=sample_indexes ) and now i can view the consisting data that i created on my summary indexing server and now i can now used my created indexes from my summary indexing server to create a dashboard. and now i am asking this is right or i am just wasting my time? Thanks and regards Cris Please don't hesitate to ask me if i need to elaborate more my question Thanks thanks ... View more

Ok got it but can i ask you again after i do a test for it? thanks a lot! Regard Cris ... View more

Hi, I have exact the same problem (rhel not windows system) I just follow instructions from http://docs.splunk.com/Documentation/Splunk/latest/Data/SendSNMPeventstoSplunk but I can not receive anything in /var/log/snmp-traps. If I start tcpdump -i eth0 'port 162' I can see snmp events arriving my server, but looks like snmptrapd can not write them into file. Anyone could give me a hint to advance? no iptables or any other firewall is running. Thanks in advance ... View more

3.3 fixed it ... View more

This would be help!! http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/RemovedatafromSplunk Just ready carefully... and always backup your files!! Regards Cris ... View more