I am trying to build some modular documentation as a Splunk app on a site with a indexer- and search head cluster.  Some of the reasoning behind this is that I spend quite some time researching existing configuration when I'm about to make new changes .  Thus I would like to be able to create views showing me details from props, transforms and indexes on the search heads. My question is; do you see any potential pitfalls by having the configuration on search heads as well as the indexers?  Or, are there any other solution for being able to view configuration on the indexer peers from the search heads? Cheers! ... View more

I have configured props.conf and transforms.conf on a Heavy Forwarder in order to split an existing sourcetype into sub categories. I have utilized what appears to be the general convention for naming layers in sourcetypes ie: a:b:c:d. Now, the sourcetype I am splitting is a:b which are generating a:b:c and a:b:c:d. Everything is working fine and I am getting the data into the indexes and the formatting is perfect. What is bothering me is that in order to search for the a:b:c and a:b:c:d source I have to use a trailing wilcard. As a:b:c and a:b:c:d each contain quite a bit of data I would like to look at either or. Its in no way a show-stopper but I would just like to check if I have missed something with regards to the config or if this is just the way it is. props.conf [a:b] TRANSFORMS-changeSourceType = set:a:b:c, set:a:b:c:d BREAK_ONLY_BEFORE = (%)|(VOIP_CALL_STATISTICS) transforms.conf [set:a:b:c] DEST_KEY = MetaData:Sourcetype REGEX = (%VOIP) FORMAT = a:b:c [set:a:b:c:d] DEST_KEY = MetaData:Sourcetype REGEX = (VOIP_CALL_STATISTICS)|(DSP) FORMAT = a:b:c:d Edit: After some further investigations it gets even stranger where I have to include a search word in order for data to displayed in addition to the trailing wildcard: index=something sourcetype=a:b:c:d* gives no results. index=something sourcetype=a:b:c:d* foo gives results containing foo . I forgot to mention I am running version 6.5.0. ... View more

Hi, I am trying to display a blob on a map in a view created with the Sideview Utils Sideview Editor. I have a search which populates the correct data so it is presentable by for example HERE Maps and the built-in maps in Splunk. However, I am unsure on how to implement this either by the Sideview Editor or in the XML. The layout of the map and the design of the blob is of minor importance I am (at first at least) only attempting to display the current location of a mobile device. Can anyone point me in the direction in order to get this work? ... View more