apply to data input instance where data is first read by Splunk props.conf [too_small] PREFIX_SOURCETYPE = false PREFIX_SOURCETYPE = <boolean> * NOTE: this setting is only relevant to the "[too_small]" sourcetype. * Determines the source types that are given to files smaller than 100 lines, and are therefore not classifiable. * PREFIX_SOURCETYPE = false sets the source type to "too_small." * PREFIX_SOURCETYPE = true sets the source type to "<sourcename>-too_small", where "<sourcename>" is a cleaned up version of the filename. * The advantage of PREFIX_SOURCETYPE = true is that not all small files are classified as the same source type, and wildcard searching is often effective. * For example, a Splunk search of "sourcetype=access*" retrieves "access" files as well as "access-too_small" files. * This setting applies at input time, when data is first read by Splunk software, such as on a forwarder that has configured inputs acquiring the data. * Default: true   ... View more

There is a 'typo' in my config. Is should be 'stateOnClient = enabled'. Missing a 'd'. After fixing this it worked fine 🙂 ... View more

I ended up skipping all lists in [global] and just do my config in the serverClass stanzas (and :app:xxx). It finally worked. Still, I would like to have my previous question confirmed or not: "So, in my config above, if I don't put the global whitelist, the whitelist in some-app would "overrun" the inherited machineTypes from the Windows class, and linux servers would be a match for the app?" Put another way, will a whitelist.0 = * in a :app:xxx stanza overrun a parent serverclass machineTypes filter, or will '*' only apply to the supplied machineTypes servers? ... View more

Agreed - Its the quantity of files and the directory structure which makes more of a difference. You can have 50GB of data in 10 files and it'll work fine, if you then have 50GB of data in 5000 files across 50 directories your going to see CPU going high. ... View more

Awesome. Thank you, Joffer! ... View more

@MichaelWilde - kindly update the link, as its not opening now. ... View more

Either one will work, but if you use both, only whitelist / blacklist will work (not _whitelist / _blacklist ) ... View more

according to your answer to 2) - do you have some good links for doc/webpages on how to change the host variable and do a reindexing? By reindexing you mean change the variable(s) on the splunk indexer and then reindex the data, or is it something else? Sorry if it's a noob question, but still just at the beginning of my splunk self-education and want to get things right 🙂 ... View more

I did an upgrade from 4.1.3 to 4.1.4 on my Windows 2008 server (none R2). I stopped splunk first, ran the msi file and checked splunk status. It was only running splunkd as the 4.1.3 config was configured to. But, the SplunkWeb service was reset to "automatic" so I did a reboot of the server, and SplunkWeb was back running after a reboot. "splunk disable webserver" or "splunk enable app SplunkLightForwarder" did not change SplunkWeb startup status, so I still have to set it to disabled or manual in Windows Services GUI.. ... View more

current_only seems intended for initial data setup only, to be the "don't backfill" option. It would make no sense if it also didn't ingest queued data during a reboot. If that were the case there would be a HUGE need for a "current_only_but_keep_data_during_reboots" option, which clearly doesn't exist. Also I think it would go against the paradigm of elegant software development to have current_only not ingest queues after reboots. Also that option of ingesting queues after reboots or not would definitely be specified in a different .conf file and not inputs.conf. I don't have the official answer for you, but, yes, current_only will definitely still ingest data queues after reboots or short periods of starting and stopping. Long term? Like turning Splunk off for a week? I don't know. ... View more