I recently added a new splunk server in a distributed environment. Now, when I do this search: index=os earliest="09/01/2015:09:30:00" latest="09/01/2015:09:35:00" | timechart count by splunk_server the new splunk server does not show up in the results. However, if I do this search, index=os splunk_server=* earliest="09/01/2015:09:30:00" latest="09/01/2015:09:35:00" | timechart count by splunk_server then, it shows up. Can anyone tell me why? I have the search load-balanced so I have about the same number of events going into each indexer. Thank you in advance. ... View more

I have a data source that looks like this: I0908 09:35:18.395637 3109 vdisk_micro_migrate_egroup_op.cc:1075] ... I0908 09:35:18.395697 3109 vdisk_micro_migrate_egroup_op.cc:77] ... I0908 09:35:18.395843 3146 egroup_delete_op.cc:52] ... I0908 09:35:18.399770 3146 disk_manager.cc:1624] ... I0908 09:35:18.504919 3106 vdisk_distributed_oplog_slave_write_op.cc:516] ... After forwarding to the indexer, my events contain multiple lines of data - it seems to break after approximately 4000 characters. I added this in the props.conf for the application that deals with the data: [storage:log-Info] SHOULD_LINEMERGE = false LINE_BREAKER=([\r\n]+) I know that this is the default setting anyway but it does not seem to be working. How would you go about debugging or is there any log that shows me how the events are being formed? BTW, I also tried changing the LINE_BREAKER regex to LINE_BREAKER=([\r\n]+[I,W,E,F][0-1][0-9][0-3][0-9]\s[0-2][0-9]:[0-5][0-9]:[0-5][0-9].[0-9]{6}) No luck. ... View more

I wanted to find out how other organizations are handling UF updates. Do you have any formal process in place? Tools that you use to do this? This is related to the heartbleed vulnerability. Although we understand that the risks are very low for internal machines, our policy dictates that we take care of all vulnerabilities. ... View more

I followed the instructions for installation of the MS SQL Server App and I have some data in the dashboard. However, it looks like I am only getting information from the systems databases. My user databases do not show up in the app. Does anyone know what I am missing? Thanks in advance. ... View more

I made the mistake of creating an index while in the launcher app. The effect is that when I go into Settings, Index, the App column shows "launcher" instead of the app that the index should be in. The index already has some data in it so I am hesitant to delete and start over. Is it possible to change the "app" of an index? Or should I not even worry about it? ... View more

I just wanted to check to see how everyone goes about creating indexes. Right now, we seem to be creating a new index for each source that we ingest into splunk. So my question is - are we going about this wrong? Should we be putting more data in main? What are the pros and cons of creating separate indexes vs putting everything together in fewer indexes? ... View more