Abhayneilam - sorry - have been out of the loop on 'real' work (lol). As Drainy says, post your xml here and peeps can do some deeper rooted analysis for you.. Br D ... View more

The plug-in Splunk-on-Splunk SOS has this pre-built for you, which might save you some work. The option is available from the splash page, the last of the searches on the right hand side. It queries $SPLUNK_HOME/var/log/splunk/license_usage.log. The option to search 'all time' is supported. Good luck! 😉 ... View more

Take a look at 'Splunk on Splunk' as a plug-in. It's a great tool. This extends the standard (which I assume you've already seen) stats in the Search > Status > Search Activity info. SoS shows you the issues whether disk related, paging and memory. Good luck 😉 ... View more

Others have asked this question before. See Splunkbase: http://splunk-base.splunk.com/answers/10135/reduce-an-index-size ... View more

Just thinking. You seem to have covered or checked the right areas. I don't know your experience level, but the inputs.conf data is correct? If you want to check that then post it here. Did you restart Splunk? 😉 If all of the above are ok, then take a look at the event data coming through from the native Search end. ... View more

Is it throwing you an error (and what is that), or are you seeing 'no results found'? ... View more

;-))...it happens to us all. Good luck with the MySQL DB Connect - its a neat start point and opens a LOT of doors as to where you can go with the data. ... View more

By the way - did you restart the app or server on which the database is placed, or is used by? Assuming that is feasible and reasonable to do so, of course 😉 ... View more

That sounds to be correct. The Java DBC needs to be installed (placed) and you also need the JRE - in fact I found the fuller version to work better. You need to restart Splunk as well. Go into the dashboard and see if the 'green light' is on next to the bridge. Do you have the installation notes? They are very good. Jar files are compacted / a type of zip files. You will need to unpack it. ... View more

Yes it is a full instance. In that context. Splunk release the full package. It will give you 30 days on the license then you need to either allow it to roll over to a free license (which doesn't have certain functionality such as user credentials and a few other bits - all of which is documented), or buy an enterprise license. You can add plug-ins such as Hadoop, as you indicate. There isn't a Hadoop Spunk version if that is what you mean. It's a Splunk instance to which the Hadoop plug-in has been installed. ... View more

I didn't see M/soft access in the supported list BUT the plug-in is v flexible...providing the custom properties are considered, and ODBC / JDBC has been placed in the $SPLUNK_HOME/etc/apps/dbx/bin/lib. Sounds 'physical' with the path error... ... View more

Have you talked to anybody at Splunk about this? There seems to be some traffic here in the Splunkbase concerning limitations. See these links: http://splunk-base.splunk.com/answers/67071/new-pdf-generation-limitations http://splunk-base.splunk.com/answers/68250/splunk-5-and-new-pdf-built-in-feature Drainy outlines a work-around for advanced xml dashboards in the 2nd link. ... View more

When you say 'log in' you are trying to connect to it through the GUI? It doesn't support that. You can access it via the CLI and there is a rich thread on the commands at http://docs.splunk.com/Documentation/Splunk/latest/Admin/CLIadmincommands (thanks Drainy 😉 ... View more

I don't think you will find that Splunk can tell you that, at least not directly. It is interesting though! You can lock your systems down of course, and log / see if a person SU's up to root but ideally they shouldn't have root access as it totals your change control and protection of the systems. If you use a 3rd party product for asset discovery (software type) and that logs information then you can bring it back into Splunk as the point of control. Solaris has pkginfo for example. ... View more

Saw this - hope its useful: http://splunk-base.splunk.com/answers/8688/monitoring-novell-edirectory-events-with-splunk br D ... View more

If there is an active firewall in place of any type then it would need to be configured to allow your TCP or UDP traffic through it for the respective ports. If it isn't enabled, then there are no such constraints. Splunk doesn't care...as in your forwarders will attempt to send regardless. Splunk doesn't 'know' about your firewalls unless they are being log monitored as well by an app. ... View more

Interesting. I am under the impression iro your Q that restart does pretty much as you expected in the 2nd para, stopping the services first...and that the restart element kicks everything off WITH due consideration now to apply any mods just made in the configs files. Any messing with them may alter your stability state, but amending user privileges shouldn't figure in that... Did you do anything else?! 😉 ... View more

Well points to you for diving in with Splunk AND Snort all in 1 go plus the comprehensive data provided! 😉 Just clarify please...2 searches, 2 fields (understood) of which you want only 1 of those - based on what criteria? End result is that you wish to see session times per connection between source and destination? ... View more

I should add - xml with the tag data makes it eminently usable within Splunk, so less issues in respect of field identification even if you have to use regexes. ... View more

Stefan, I haven't seen specific .net plug-ins (though clearly there is a potential following ;-), but Splunk will index your logs ok. Search xml in the splunk base for more. The following shows a few tweeks you may need to consider within the inputs. conf and props files using whitelists. I'd be interested to see how it went...let us know. Br D http://splunk-base.splunk.com/answers/7275/index-xml-log-files ... View more