I have an alert that I created. When I click "Open in Search and trigger the event, it shows up in the search window, but the event does not trigger the alert (send e-mail, execute the script, or show up in Triggered Alerts). The alert is in the savedsearches.conf file in system/local and shows up with the Owner as "nobody", the App as "system" and Sharing as "Global". What can I do to fix this problem? I have several alerts and it appears that none of them are working properly at this time. UPDATE: It appears the number of searches may be partially responsible. When I have just one real-time alert in the savedsearches.conf file it appears to work correctly, but when I get up to 6, it stops working. The requirements being fulfilled by Splunk require as many as 14 real time searches to trigger alerts when necessary, so I definitely need some kind of solution to this problem. ... View more

How can I set up an alert to run a script in a location other than $SPLUNK_HOME/bin/scripts? The scripts I need to run if the alerts I'm creating are triggered are installed by another product that my team has developed and is called by tools other than Splunk, so I can't just copy it over to a new location. I suppose I could create a wrapper script for each alert and copy them to the Splunk location as part of my install process, but that seems inefficient. ... View more

How can I capture WMI data from the local machine in Splunk? The program I am working on has a preexisting tool that used WMI to report data from SNMP devices (UPS, environment monitors, etc) to our NetIQ instance rather than writing it out to a flat file to be read in. We don't have the budget to modify that tool as part of migrating to Splunk and all the information I've found for monitoring WMI data in Splunk assumes it is from a different machine and correspondingly requires a domain account instead of being able to run as the local service user. How can I capture data from the local machine using WMI (preferably continuing to install Splunk as the local user)? ADDITIONAL DETAILS: I have confirmed that the Windows SNMP Service and SNMP WMI Provider are installed on the same machine that the Splunk indexer is running on. Since they're on the same machine, no network traffic should be required. Thanks. ... View more

From what I've been able to find, McAfee Host Intrusion Prevention does not write to its event.log file in a human readable format. How can I get that read in by Splunk in a useful format? A previous answer I found (http://answers.splunk.com/answers/95340/mcafee-epo-integration-with-splunk) talked about configuring ePolicy Orchestrator to create a text log file, but wouldn't that cause the source of all the events to be listed as the ePolicy server as opposed to the computer the event actually occurred on? ... View more