Hello jainbhavuk360, Couple of possibilities, 1. run splunk universal forwarder in the docker container, and setup a scripted input (will need to be a shell script that essentially runs docker stats command or whatever other) with some frequency. Make sure splunk universal forwarder is setup to forward the logs to splunk instance. 2. run your own script in the container that periodically runs docker stats or whatever other comments and posts the output of it to an HTTP Event collector on Splunk via HTTP(S). Happy splunking. -Dhananjay ... View more

Hello, Have you looked into splunk logs to find out if there is an error in sending emails? Also there are a lot of answers queries around troubleshooting emails not getting sent. See for example: https://answers.splunk.com/answers/330817/how-to-troubleshoot-why-im-not-getting-email-alert.html https://answers.splunk.com/answers/32498/how-to-troubleshoot-splunk-email-notification.html https://answers.splunk.com/answers/221223/how-to-troubleshoot-why-i-am-not-receiving-emails.html https://answers.splunk.com/answers/225648/alert-email-not-being-sent.html Hope this helps. -Dhananjay ... View more

Hello arajesh456, Have you looked at HTTP Event Collector ? Although the article talks about Splunk Enterprise, it works perfectly fine with Splunk Light as well. Also, other ways of getting data from external applications are to setup a universal forwarder on the host where application is potentially writing logs (if that's the case), and having forwarder monitor the folder where log files are and forward it to Splunk Light instance. You can read information about it here. -Dhananjay ... View more

Please look at https://answers.splunk.com/answering/432688/view.html for a temporary workaround, till Splunk gets this fixed. ... View more

apologies for misleading instructions, I have updated my answer before, and verified that workaround works in my trial environment. Please give it a try. ... View more

Hello John, In Cloud deployment, TCP monitoring is not supported. You options are to either to use HTTP Event Collector, (I believe hiroku supports HTTPS data drains). Or, you can host a Splunk Forwarder, and enable TCP input for receiving hiroku data as syslog (which will then route it to your Splunk Light cloud instance). HTH, -Dhananjay ... View more

When you switched to Light Free mode, did you restart Splunk Light? Can you put the output of following commands (assuming Linux): $SPLUNK_HOME/bin/splunk list licenser-groups and $SPLUNK_HOME/bin/splunk list licenser-pools ... View more

First check if when monitoring local/native FS directory, Splunk Light is able to index the newly created files. If it's not able to it usually may mean that newly generated files are too similar and you are getting a crccheck issue (where the crc of the files is similar and splunk doesnt index because it thinks its the same file. Basically the first 256 bytes of the files are the same, in this case look for crcSalt in inputs.conf) Of course it's possible that there's some config issue with S3FS. I haven't really used S3FS to give much input on config changes on S3FS side. But quick searching on the web following maybe pertinent -- Are you using local cache of S3FS for example. If you are using local cache, you may need to look at periodically purging "~/.s3fs" ... View more

Hello Voffka, When connecting to cloud, please use https://input-xxxxx.cloud.splunk.com:8088/services/collector/event More details can be found at HTTP Event collector walkthrough ... View more

By default the latest are on the top, but the latest is determined by the timestamp and not by custom field. If your data from database has timestamp, then you should associate that field as timestamp, (I did not see any time field in your raw event in the screenshot) then search results will automatically sort by the latest on top. For any custom field, such as wid in this case, you will have to sort it by | sort command. ... View more

Note that in Splunk Light, since it's a single instance, indexer is running with search head and splunkweb on server1 in your case. When you go to Splunkweb, in the search results (same as your screenshot), you can see the fields Splunk Light has auto-extracted for you. Click on the 14 more fields, and see if the id field is auto extracted, if it is, then use that field name for sorting, using | sort command as per suggestion above. If the id field is not auto extracted, please click on the extract new fields flow, which will take you to field extraction UI wizard, that will let you choose part of the event as a new extracted field. Hope this helps. ... View more

Looks like there is a bug introduced in the recent version that is preventing UI from working. As a work around you can go to the machine where forwarder is running, and manually create (if none exists) inputs.conf file in /etc/system/local folder and update/add TCP input there and restart the forwarder (/bin/splunk restart). Example stanza for receiving syslog via TCP input (update for your port and source type as appropriate): [tcp://33333] sourcetype=syslog disabled=false ... View more

Exactly Seth. Setup TCP input port on your universal forwarder, that will receive Hiroku log stream data, and forward it to Splunk Light cloud. ... View more

For Splunk Light Cloud, you cannot open up a new TCP inputs, due to security constraints. You could use Universal Forwarder to forward Hiroku logs (if they are file system based) to Splunk Light Cloud Service. See how to setup forwarders for Splunk Light Cloud Alternatively, HTTP Event collector should work just fine. See here for the details about HTTP event collector. The URL is of the form: curl -k https://hostname:8088/services/collector/event -H "Authorization: Splunk " -d '{"event": "hello world"} ... View more

Hello Voffka, Can you give example of curl request you are trying? Also did you make sure that a HTTP Event collection is enabled and a new token is generated? -D ... View more

Suggest using the latest version of the doc What Splunk logs about itself ... View more

Splunk Light in the current version does not allow editing server classses via UI (something that will be fixed in upcoming version), but you can always update/edit serverclass.conf file manually (and then restart Splunk Light for the changes to be effective) Document here is also applicable to Splunk Light: http://docs.splunk.com/Documentation/Splunk/6.3.3/Updating/Definedeploymentclasses You can always delete the inputs by going to Data inputs page ... View more

Hello danielphome, Assuming you are using a download trial of Splunk Light (and not Splunk Light cloud service), see http://docs.splunk.com/Documentation/SplunkLight/latest/GettingStarted/Editaccountsettings to give yourself permission to delete the data. If you are using Splunk Light Cloud service, let us know, since the process is different. -DJay ... View more

I am not aware of any way to import existing dashboards/reports/alerts to Splunk Light cloud instance. That sounds like a darn good enhancement request to Splunk Light. Splunk Light Cloud service only supports HTTPS for HTTP Event collector. I don't think there is a way to use custom certs on Splunk Light Cloud. I strongly suggest you use heavyweight forwarder as a intermediate node for your existing sources to send data to, and heavyweight forwarder sends data to the cloud service. Hope this helps. -DJ ... View more