Our current Splunk Infrastructure has: 1) 1x Splunk Search-Head: has Splunk_APP_Stream and SPlunk_TA_Stream 2) 2 x Indexers: has Splunk_TA_Stream 3) 1x Deployment App Server: has Splunk_TA_Stream We are collecting AWS PostgreSQL CloudWatch logs using a Heavy Forwarder containing the Splunk Add-on for AWS. Would be possible to forward logs to our Splunk Search-Head from HF using SPlunk_TA_Stream? If not, would you please provide me with a recommended solution? Thank you, Marcio. ... View more

We're trying to understand what our growth rate is in Nexus usage. I've been asked to find the unique number of users that log in month over month for the last year or so. The following search correctly counts the number of unique usernames over the timespan of the search. index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" | stats dc(username) But I've been unsuccessful in getting the results for number of unique usernames for Jan, Feb, Mar, etc. I've tried all kinds of combinations. Can someone help? THANKS! ... View more

Checking conf files for problems... Improper stanza [dhcpd_server_dhcprelease] in /opt/splunk/etc/apps/unix/default/tags.conf, line 30 Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' When I run splunk btool check --debug, I get these errors No spec file for: /opt/splunk/etc/apps/SA-Hydra/default/hydra_gateway.conf No spec file for: /opt/splunk/etc/apps/SA-Hydra/default/hydra_node.conf No spec file for: /opt/splunk/etc/apps/SA-ldapsearch/default/ldap.conf No spec file for: /opt/splunk/etc/apps/SA-ldapsearch/default/logging.conf No spec file for: /opt/splunk/etc/apps/Splunk_TA_nix/default/eventgen.conf No spec file for: /opt/splunk/etc/apps/Splunk_TA_ontap/default/hydra_node.conf No spec file for: /opt/splunk/etc/apps/Splunk_TA_ontap/default/ta_ontap_collection.conf No spec file for: /opt/splunk/etc/apps/ossec/default/ossec_servers.conf No spec file for: /opt/splunk/etc/apps/splunk_management_console/default/logging.conf No spec file for: /opt/splunk/etc/apps/unix/default/eventgen.conf No spec file for: /opt/splunk/etc/system/default/conf.conf No spec file for: /opt/splunk/etc/system/default/prefs.conf No spec file for: /opt/splunk/etc/system/local/migration.conf ... View more

I suspect that multiple VMs (as yet unconfigured in our environment) are getting lumped together in the index under a single hostname ("unconfigured-win2008r2"). I'd like to verify this by finding the IP addresses that these events are coming from. How do I do this? thanks. ... View more

This has to be splunk 101. There has be something better than NOT sourcetype=top NOT sourcetype=ps NOT sourcetype=openPorts Something along the lines of NOT sourcetype in (top, ps, openPorts) ??? Thanks for the help! Oh .. and one more question, there's a shortcut to insert "NOT sourcetype=blah" by holding down a key combination and mouse clicking on the "blah" in the current search results. What is the key combination on both windows and mac? Thanks. ... View more

My alerts are working as I intended. I get the email. The email contains the link to the results. Going to that link serves up the following error: Error in 'SearchOperator:loadjob': Cannot find job_id 'rt_scheduler_a2FybGEucnVzc2VsbA__search__RMD5033f04f8e659bd94_at_1393513652_3103.1'. When I go to Activity->Triggered Alerts, I'm told "No triggered alerts found. " Any ideas? thx ... View more