Will the sourcetype change when the index has more than 100 events? If you start indexing with followTail = 1 in the config(s), there will never be 100 events the first time... ... View more

There is a 'typo' in my config. Is should be 'stateOnClient = enabled'. Missing a 'd'. After fixing this it worked fine 🙂 ... View more

Isn't this the defaults? I copied it from /apps/ and did not touch any files after that. If I create a local/app.conf with state = enabled it works, but I didn't think I had to do that when I use deployment server - I enable the app in serverclass.conf ... View more

I've got a followup question... I've now copied the SplunkLightForwarder into my deployment folder. I did not add any new files/config to that app. My serverclass.conf for that app is as follows: [serverClass:LightForwarder:app:SplunkLightForwarder] stateOnClient = enable restartSplunkd = true The app is distributed to the clients and enabled, but the webserver is still running. Why? Do I need to add a local/app.conf (or should I enable default/app.conf?) file to the folder and 'enable' it there? I thought the stateOnClient should take care of that and enable the app and hence disable the webserver? ... View more

I ended up skipping all lists in [global] and just do my config in the serverClass stanzas (and :app:xxx). It finally worked. Still, I would like to have my previous question confirmed or not: "So, in my config above, if I don't put the global whitelist, the whitelist in some-app would "overrun" the inherited machineTypes from the Windows class, and linux servers would be a match for the app?" Put another way, will a whitelist.0 = * in a :app:xxx stanza overrun a parent serverclass machineTypes filter, or will '*' only apply to the supplied machineTypes servers? ... View more

Yepp, thats where I found it 🙂 ... View more

Thanks for the info and the effort, and not to be rude, but I don't think you read my post very thorough... I have the deployment up and running and working just fine 🙂 I did have a question/discussion (with my self?!!?) about SplunkLightForwarder. What are your contents of the /Applications/splunk/etc/deployable-apps/SplunkLightForwarder? Did u copy or link the $SPLUNK_HOME/etc/apps/SplunkLightForwarder to /Applications/splunk/etc/deployable-apps/SplunkLightForwarder? Please read on my post again 🙂 ... View more

One important thing I noticed is that my Windows x64 servers sends an utsname=windows-x64 to splunk, and not windows-intel as I thought. ... View more

So, in my config above, if I don't put the global whitelist, the whitelist in some-app would "overrun" the inherited machineTypes from the Windows class, and linux servers would be a match for the app? ... View more

Do you use the LightForwarder or the normal Forwarder. The normal Forwarder can/will index your data and use diskspace etc. It will then take a bigger hit on your system. How much I don't know. ... View more

the whitelist doesn't work for my splunk lightforwarder. Even though the simple whitelist should be correct it is not forwarded. ... View more

By testing this simple regex in RegexBuddy (http://answers.splunk.com/questions/5092/regex-crash-course) with the entire folder structure I have I see whitelist=\\logs\\ is correct (not that I doubted). My question is then, why does splunk list monitor list all the other folders? ... View more

Sweet. RegexBuddy will probably help me alot 🙂 ... View more

I have subfolders under \logs. C:\inetpub\sites\www.fqdn.com\logs\ C:\inetpub\sites\www.fqdn.com\logs\W3SVC4\ (the log files are here - *.log) C:\inetpub\sites\www.fqdn.com\logs\FTPSVC4\ (log files are here - *.log) C:\inetpub\sites\www.fqdn.com\www\ C:\inetpub\sites\www.fqdn.com\www\xxx\ C:\inetpub\sites\www.fqdn.com\www\yyy\ C:\inetpub\sites\another.fqdn.com\logs\ C:\inetpub\sites\another.fqdn.com\logs\W3SVC7\ C:\inetpub\sites\another.fqdn.com\logs\FTPSVC7\ C:\inetpub\sites\another.fqdn.com\www\ C:\inetpub\sites\another.fqdn.com\www\ (webfiles files here) C:\inetpub\sites\another.fqdn.com\www\aaa\ (more webfiles here) C:\inetpub\sites\another.fqdn.com\www\bbb\ (more webfiles here) What I want, which I think you guys understand, is to monitor all log files under \logs\, no matter what the fqdn folder name is, and what folders are under \logs. I confirmed that if I monitor the C:\inetpub\sites\lebara.stag.carrot.no\logs\W3SVC4\ the logs are indexed (as it should), but I can't seem to get the correct config with wildcards etc... Update: If i add whitelist=\\logs\\ I get this output from splunk list monitor : C:\inetpub\sites\ C:\inetpub\sites\www.fqdn.com C:\inetpub\sites\www.fqdn.com\logs C:\inetpub\sites\www.fqdn.com\logs\ProfileWS C:\inetpub\sites\www.fqdn.com\logs\W3SVC3 C:\inetpub\sites\www.fqdn.com\www C:\inetpub\sites\www.fqdn.com\www\App_Data C:\inetpub\sites\www.fqdn.com\www\aspnet_client etc... (for each website) If I add a '*' after the last backslash - whitelist=\\logs\\* - I get the logfiles in the monitor list at least, but still \www\ : C:\inetpub\sites\ C:\inetpub\sites\www.fqdn.com C:\inetpub\sites\www.fqdn.com\logs C:\inetpub\sites\www.fqdn.com\logs\ProfileWS C:\inetpub\sites\www.fqdn.com\logs\ProfileWS\ProfileWS.error.log C:\inetpub\sites\www.fqdn.com\logs\ProfileWS\ProfileWS.log C:\inetpub\sites\www.fqdn.com\logs\W3SVC3 C:\inetpub\sites\www.fqdn.com\logs\W3SVC3\u_ex100725.log C:\inetpub\sites\www.fqdn.com\logs\W3SVC3\u_ex100726.log C:\inetpub\sites\www.fqdn.com\logs\W3SVC3\u_ex100727.log C:\inetpub\sites\www.fqdn.com\www C:\inetpub\sites\www.fqdn.com\www\App_Data C:\inetpub\sites\www.fqdn.com\www\aspnet_client I'm getting quite frustrated here 😞 And regex is almost like greek to me. Update 2010-07-29: I'm now running with the whitelist = \\logs\\ config, but no logs gets sent to the splunk indexer. Checking splunkd.log I see this (and lots of the same kind): 07-29-2010 16:07:59.495 INFO TailingProcessor - No configurations match, will ignore path='C:\inetpub\sites\www.fqdn.com\www\bin\CIF.xml'. 07-29-2010 16:07:59.511 INFO TailingProcessor - No configurations match, will ignore path='C:\inetpub\sites\another.fqdn.com\logs\W3SVC7\u_ex100729.log'. 07-29-2010 16:29:20.013 INFO TailingProcessor - No configurations match, will ignore path='C:\inetpub\sites\www.fqdn.com\www\bin\CIF.xml'. As you all can see, it doesn't match the \logs\ folder and therefor the logs aren't sent to my indexer... Isn't this strange? ... View more

I do presume that splunk list monitor lists everything thats being monitored... ... View more

It did not work, still lists the \www\ files&folders as well. Do I need a blacklist as well then? Or should it only grab the \logs\ folder and nothing else? I'm using 4.1.4 btw. ... View more

I will try. Will it work in combination with fschange later when I want to add that to the \www\ folder for tracking changes to the html/php/aspx/js/etc files? Would it be as simple as creating a fschange and a 'whitelist=\www\' to do this? ... View more

according to your answer to 2) - do you have some good links for doc/webpages on how to change the host variable and do a reindexing? By reindexing you mean change the variable(s) on the splunk indexer and then reindex the data, or is it something else? Sorry if it's a noob question, but still just at the beginning of my splunk self-education and want to get things right 🙂 ... View more