Do we have to install App on search head also to query the data? We are using Search head clustering and it is mentioned in doc to go through Heavy Forwarder route as it is not supported with SH clustering. How I can query the data using HF route? Thanks Hemendra ... View more

UPDATE: Now the query does not use the tail effectively. I have RecievedUTC as the incrementing field (epoch) and I get the same records or no records at all. There are no log entries that show any errors either. So how can I query the database to send me events created from the previous hour? ... View more

You will also need to make sure that the path to python is in Splunk's system path and that all the necessary modules (e.g. splunk, splunk.search, splunk.auth) are present. ... View more

how did you solve your problem? any suggestions? ... View more

Oh nuts. Sorry - I somehow missed that these werent floats, but rather version strings with multiple decimal points. I'll update my answer ... View more

New Link: http://docs.splunk.com/Documentation/Splunk/latest/Data/TuneTimestampExtractionForBetterIndexingPerformance#Disable_timestamp_processor ... View more

Are you sure that you are actually searching in your dedicated syslog-index? You didn't specifically mention it. index=host-syslog sourcetype=syslog host=syslog-server-host1 etc etc. BR, Kristian ... View more