The GUI is sooooo slow. If you run a search results are pulled in fast, the page is already loaded. The problem is when navigating around the GUI loading new pages, dashboards or even configuration settings. There is a significant delay in the server sending the html page back to the user. Our old search head which is still online 6.3.2 is blazin fast. I'm not talking about searches I'm talking about page loads. Purely the hosting of the GUI. We built a new search head cluster on new systems which are physical, SSD loaded, tons of RAM awesomeness. Currently these systems are 6.5.0. Even our stand alone non-clustered 6.5.0 search heads are slow. Does anyone have an idea to this issue? Does anyone have an idea where the web-hosting component of splunk is and how to adjust performance settings. Else is there a way to decouple the hosting of the splunk GUI and move it to Apache etc? ... View more

Hi, I'm attempting to consume MSSQL ERROR logs from 800+ systems with different log locations. The current approach is to configure a common directory on the C drive c:\mssql logs\ with up to 10 symlink links within. Each link corresponds to LOG folders of different MSSQL Instances. C:\MSSQL LOGS\LOG1 C:\MSSQL LOGS\LOG2 C:\MSSQL LOGS\LOG3 ... etc For example symlink LOG1 points to C:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Log My current inputs.conf is not working however one that points to the actual does. I need 2 questions answered. 1. What is the correct method to consume symlinks 2. Is there a better approach to deploy & consume MSSQL ERROR logs from a large amount of systems. Thanks [monitor://C:\MSSQL LOGS*] - Does not work [monitor://C:\MSSQL LOGS\LOG4*] - Does not work inputs.conf [monitor://C:\MSSQL LOGS*] followSymlink = true recursive = true index = stage_idx sourcetype = mssql:errorlog disabled = 0 ... View more

My search results return a list of FQDN domain names. I need to replace that domain name with an app name when a portion of that domain name is located. For example this would be the output from my index office365.com outlook.office365.com sharepoint.office365.com office.com fbcdn.net This is my current search which works but becomes extremely slow when adding a lot of match lines. This search looks for any domain even if it contains subdomains. For example X10232.fbserver.fbcdn.net. The Facebook line below would match on any *.fbcdn.net domain. I also need to match on exacts like facebook.com index=weblogs | sort 0 -domain | eval domain=case( match(domain,"^(?=.*\bwordpress.com\b).*$"),"WordPress", match(domain,"^(?=.*\b.sharepoint.com\b).*$"),"Microsoft Office 365 - Sharepoint", match(domain,"^(?=.*\b.office365.com\b).*$"),"Microsoft Office 365", match(domain,"^(?=.*\b.fbcdn.net\b).*$"),"Facebook", match(domain,"^(?=.*\b.facebook.com\b).*$"),"Facebook", match(domain,"^(?=.*\bfacebook.com\b).*$"),"Facebook", true(),domain) | table domain I would like preform the same matching task but from a CSV lookup list with three fields. This way I can create two new fields for each event containing appname and apptype Domain,AppName,AppType facebook.com,Facebook,Social Media office.com,Office 365,Productivity fbcdn.net,Facebook,Social Media ... View more