Thank you so much. Could you fix the spelling of feld --> field so that others don't get an error and have to figure that out. ... View more

First off I would encourage you to run your regex through regex101 https://regex101.com/r/koEOps/1 Next can you please provide a sample of the file names. You can also 'save' these in the regex101 as well as here. Did you verify file permissions and did you look in /var/log/splunk on a forwarder where the data is? Are you using a regex in the monitor as well? "(NFT|NFOT)"? If you read when and when Regex works (https://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Specifyinputpathswithwildcards ). You may need to add a * after your regex. e.g. (NFT|NFOT)* Lastly you did not escape your last . (via .) which should not matter here, but it's good practice. ... View more

I downvoted this post because the url was referenced in the question. the answer has not value. ... View more

This file existed for me... But I still needed to install the pam module. https://answers.splunk.com/answers/108996/error-while-configuring-check-point-opsec-lea-linux-app.html ... View more

I have a rule to minimize rate of change when possible, so I would follow a 5 step process. 1) Add NewApp (cp OldApp NewApp) 2) Using the Deployment GUI, map the NewApp to the same set of clients as the OldApp was mapped to Wait-Verify 3) Remove the OldApp from clients Wait-Verify 4) Remove the OldApp from the CLI 5) Modify NewApp as needed On to your next question... If you are moving something from system-local then you are correct. That would be step 4 above - then you would still need a service restart. If you would like to understand where you are getting configurations from use the btool command. ./splunk cmd btool props list --debug ... View more

Did you ever figure out the correct way to load balance? ... View more

What was happening in the files were being put into /splunk/data/defaultdb/db (and then the system created rawdata under this. I figured I would share my script as it was very nice to have this. You will make 2 files Import_lanch.bash Import_run.bash you will need to chmod them them to 700 +++++++++++++++++++++++++++++++++++++ Import_lanch.bash +++++++++++++++++++++++++++++++++++++ #!/bin/bash #needed to run importtool #update SPLUNK_HOME if needed SPLUNK_HOME=/opt/splunk export SPLUNK_HOME #Set the following variables #SOURCEDIRECTORY="/swap/export" SOURCEDIRECTORY= #Need to update this to where your db directoy is. SPLUNKDATADIR="/splunk/data" #This will set up the system and ensure that it ready for the decompress. rm -f $FILEPROCESSCNT if ! [ -d $SPLUNKDATADIR/defaultdb/db/temp ]; then mkdir $SPLUNKDATADIR/defaultdb/db/temp ; fi if ! [ -d $SPLUNKDATADIR/defaultdb/db/temp/files ]; then mkdir $SPLUNKDATADIR/defaultdb/db/temp/files ; fi #This is the main call. For each file that matchs the -name, it will call Import_run.bash and import the file. find /swap/export/defaultdb/ -name "db_??????????_??????????_????" -print0 |xargs -0 -n 1 ./Import_run.bash #The below will be ran after all the import are done. # Uncomment if the system is part of a cluster. /opt/splunk/bin/splunk offline /opt/splunk/bin/splunk restart /opt/splunk/bin/splunk _internal call /data/indexes/defaultdb/rebuild-metadata-and-manifests +++++++++++++++++++++++++++++++++++++ Import_run.bash +++++++++++++++++++++++++++++++++++++ #!/bin/bash if ! [ -z $1 ]; then #Set the following variables #SOURCEDIRECTORY="/swap/export" SOURCEDIRECTORY= #leave blank if not cluster #CLUSTERGUID="_CCCCCCC2-5050-4444-BBBA-AAAAAAAAAAAF" CLUSTERGUID="" #Need to update this to where your db directoy is. SPLUNKDATADIR="/splunk/data" FILECOUNT=`ls -l $SOURCEDIRECTORY/defaultdb/db_??????????_??????????_???? | wc -l` FILEPROCESSCNT="$SOURCEDIRECTORY/FILEPROCESSCNT.foo" [ -e $FILEPROCESSCNT ] && FPC=`cat $FILEPROCESSCNT | sed 's/^\([0-9]*\).*$/\1/'` /opt/splunk/bin/importtool $SPLUNKDATADIR/defaultdb/db/temp/files $1 FPC=`expr $FPC + 1` echo "$FPC of $FILECOUNT done with file $1" echo $FPC >$FILEPROCESSCNT FILENAMEPRE=`echo $1 |cut -d "_" -f 1-3 |cut -d "/" -f 5` #Adjust 100 to a number that makes sense in your environment # e.g. a number which is 50 or 100 greater or less than your current numbers. FILENUM=`expr $FPC + 100` FILENAME+=$FILENAMEPRE FILENAME+="_" FILENAME+=$FILENUM FILENAME+="_C7B32B92-50CC-4E19-B0BA-A8B93A8012DF" mkdir $SPLUNKDATADIR/defaultdb/db/$FILENAME #This assumes that your db files are in /splunk/data mv $SPLUNKDATADIR/defaultdb/db/temp/files/* $SPLUNKDATADIR/defaultdb/db/$FILENAME mv $1 $1.done fi ... View more

Also after I mkdir /splunk/data/defaultdb/db/db_1378961993_1378907854_240 and mv /splunk/data/defaultdb/db/rawdata /splunk/data/defaultdb/db/db_1378961993_1378907854_240 do I need to do anything to tell the system that this now a searchable directoy, rebulld the meta data, or anyhting like that? (e.g. should I issue a '/opt/splunk/bin/splunk _internal call /data/indexes/defaultdb/rebuild-metadata-and-manifests' or 'touch /splunk/data/defaultdb/db/meta.dirty' and then restart splunk? ... View more

I don't think any of this matters at this level but I am doing clustering on this indexer, so I will use the splunk offline, then the splunk restart command. Do the file name - sequence number need to be in order? they are currently in the 40 range, and if I import 240, what will happen when splunk gets there? They will have different date stamps, so I'm not worried about directory collision, but will splunk be OK with duplicate sequence numbers? ... View more