I'd like to know the specific version of the third-party packages (openssl, pcre, openldap, etc.) Splunk ships with. How can I figure that out ... View more

I have one splunk forwarder I need to segregate from other indexes. I have created its own index and I need to know how to get the data from the splunk forwarder into it. I only have one port open for lightweight forwarding. Is this possible through props.conf and transforms.conf or do I need to do something different ... View more

I'm trying to set up a workflow action to send an email to someone via a CGI script on another box. I need to have that email sent from the user who's logged into splunk (who pulled down and click on the workflow action menu item), but I can't figure out how to pass the logged in user to the workflow action (i.e. send it as a data item or a part of the URL). Is this possible? ... View more

We are trying to deploy splunk with SSO according to documentation found on http://www.splunk.com/base/Documentation/4.1/Admin/Usesinglesign-onwithSplunk but are hitting a wall. The suspicion is that mod_proxy does not proxy the remote_user variable needed by Splunk. Anyone know if this and true and known a way around this? ... View more

I see lots of reference to search heads as a way to improve search performance. I can't find a search head section of the docs? What do I need to do to make a search head? Can I have a hydra splunk with multiple search heads to have even greater efficiency? What do I need to do make this happen ... View more

I've just upgraded to 4.1 and now I'm getting an error when I search saying: The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WinEventLog...'. The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WMI:WinEventLog...'. What do I need to do to get these working again? ... View more

After upgrading to Splunk 4.1 from 4.0.10 today, we find that we can no longer run searches. splunkd.log shows: 04-05-2010 16:36:33.982 ERROR SearchScheduler - The minimum free disk space (2048MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run. SearchId=scheduler_eam_search_QVNOTkVYIC0gRGV2IERCIEZhaWx1cmU_at_1270499760_1463245089 SplunkWeb says the same thing if I run a search. The filesystem in question has over 1GB free, but less than 2GB. We have minFreeSpace=500 in the diskUsage section of server.conf, but that value seems to be for indexing not search. What is the minimum disk space check value for a search? ... View more

I just upgraded from 4.0 to 4.1 and am seeing messages that the indexprocessor was not initialized on startup. How can I fix this? ... View more

I just upgraded my install to 4.1 and LDAP auth is no longer working. The failsafe user is all I can use. Previously I had roles assigned to users (groups were not part of our configuration) ... View more

I am looking to read into SPLUNK a tab delimited file. But most of what I see is key based Field Extractions (, space, etc.) Is there an example of how this might be done with TAB? ... View more

I'm creating a custom view and the only action I want to provide my users is to export results. For the TitleBar module is it possible to limit the list of actions to only export results? ... View more

It'd be cool if I could add some line breaks to my search so that visual inspection of what I was typing was a little easier on the eyes. Can this be done? ... View more

I have a light forwarder (v4.0.7) I want to change this to a forwarder instead of a light forwarder. The reason being is that I want this forwarder to add some indexed fields to the mix before the data is sent over to the main index server. What are the steps involved to make this happen? ... View more

I'm trying to write a query that 1. will find the first instance of a particular problem 2. show "all" events 15 minutes before that I have gotten this far: a. Get all the events with the particular problem: Sourcetype="my_source" problemstring b.Then to get the first 2 occurrences, I did: | tail 2 This will give me first 2 occurrences of the events with "problemstring" in them. I need "all" events. Do I need a subsearch?? Also how do I get 15 minutes before the the first occurrence? ... View more

I know that Splunk can send alerts to email addresses, we are doing this on a daily basis, what I want is send alerts to a cell phone number. How can I achieve that? ... View more

How can you differentiate between a forwarder being down and a forwarder not having any data to send ? i.e is there a heartbeat that i can tap into? ... View more

In my environment we make clones of our linux servers so that we don't have to build out a server from scratch for every new project. On my master image, I have configured a splunk forwarder to splunk to our indexer. My question is as I now make a clone for a particular project, all future clones will show up with the same hostname. How do I go about modifying the clone to reflect their new hostnames? Is it a matter of changing configuration files, or some splunk commands against the database? Are there any other considerations to take into account? ... View more

I'd like to convert a busy server with a bunch of users from default auth to LDAP. How can I do so without losing any of their saved searches and other data? ... View more

I'm concerned about CLI and REST authentication tokens. How long do those stay valid and is it configurable? ... View more

When I select the menu for host I can't see the option of edit the tag. How can I edit the tag? Can I do it by SplunkWeb? ... View more