Cool! It is not recommended to create new fields at index time. The gain is real only for few cases. The reasons are well explained here : http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Indextimeversussearchtime If you really want to create custom index fields, read this http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureindex-timefieldextraction ... View more

Hi, The sourcetype of your data must be asm_log. You have to define sourcetype=asm_log in the inputs.conf file. Exemple if you collect the logs through syslog : [tcp://syslog.corp.company.net:514] sourcetype = asm_log ... View more

Great ! I think this is a bug. I reported it to Splunk support. ... View more

This is what I was saying. The lib files are not linked correctly to each other. Your files should be : total 21060 drwx--x--x 3 splunk splunk 4096 Dec 2 2011 alsa-lib -rwx--x--x 1 splunk splunk 13358 Dec 2 2011 connect-restrict.so drwx--x--x 4 splunk splunk 4096 Dec 2 2011 gtk-2.0 lrwxrwxrwx 1 splunk splunk 17 Jul 9 18:40 libIDL-2.so -> libIDL-2.so.0.0.0 lrwxrwxrwx 1 splunk splunk 17 Jul 9 18:40 libIDL-2.so.0 -> libIDL-2.so.0.0.0 -rwx--x--x 1 splunk splunk 212570 Dec 2 2011 libIDL-2.so.0.0.0 lrwxrwxrwx 1 splunk splunk 18 Jul 9 18:40 libasound.so -> libasound.so.2.0.0 lrwxrwxrwx 1 splunk splunk 18 Jul 9 18:40 libasound.so.2 -> libasound.so.2.0.0 -rwx--x--x 1 splunk splunk 1126705 Dec 2 2011 libasound.so.2.0.0 lrwxrwxrwx 1 splunk splunk 22 Jul 9 18:40 libatk-1.0.so -> libatk-1.0.so.0.2913.1 lrwxrwxrwx 1 splunk splunk 22 Jul 9 18:40 libatk-1.0.so.0 -> libatk-1.0.so.0.2913.1 -rwx--x--x 1 splunk splunk 152640 Dec 2 2011 libatk-1.0.so.0.2913.1 lrwxrwxrwx 1 splunk splunk 22 Jul 9 18:40 libcairo.so -> libcairo.so.2.10800.10 lrwxrwxrwx 1 splunk splunk 22 Jul 9 18:40 libcairo.so.2 -> libcairo.so.2.10800.10 -rwx--x--x 1 splunk splunk 626364 Dec 2 2011 libcairo.so.2.10800.10 lrwxrwxrwx 1 splunk splunk 18 Jul 9 18:40 libdatrie.so -> libdatrie.so.0.0.4 lrwxrwxrwx 1 splunk splunk 18 Jul 9 18:40 libdatrie.so.0 -> libdatrie.so.0.0.4 -rwx--x--x 1 splunk splunk 27163 Dec 2 2011 libdatrie.so.0.0.4 lrwxrwxrwx 1 splunk splunk 17 Jul 9 18:40 libexpat.so -> libexpat.so.1.5.2 lrwxrwxrwx 1 splunk splunk 17 Jul 9 18:40 libexpat.so.1 -> libexpat.so.1.5.2 -rwx--x--x 1 splunk splunk 210354 Dec 2 2011 libexpat.so.1.5.2 lrwxrwxrwx 1 splunk splunk 21 Jul 9 18:40 libfreetype.so -> libfreetype.so.6.3.20 lrwxrwxrwx 1 splunk splunk 21 Jul 9 18:40 libfreetype.so.6 -> libfreetype.so.6.3.20 -rwx--x--x 1 splunk splunk 637870 Dec 2 2011 libfreetype.so.6.3.20 lrwxrwxrwx 1 splunk splunk 21 Jul 9 18:40 libgailutil.so -> libgailutil.so.18.0.1 lrwxrwxrwx 1 splunk splunk 21 Jul 9 18:40 libgailutil.so.18 -> libgailutil.so.18.0.1 -rwx--x--x 1 splunk splunk 37136 Dec 2 2011 libgailutil.so.18.0.1 lrwxrwxrwx 1 splunk splunk 13 Jul 9 18:40 libgcc_s.so -> libgcc_s.so.1 -rw------- 1 splunk splunk 232362 Dec 2 2011 libgcc_s.so.1 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgdk-x11-2.0.so -> libgdk-x11-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgdk-x11-2.0.so.0 -> libgdk-x11-2.0.so.0.1600.6 -rwx--x--x 1 splunk splunk 782011 Dec 2 2011 libgdk-x11-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 29 Jul 9 18:40 libgdk_pixbuf-2.0.so -> libgdk_pixbuf-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 29 Jul 9 18:40 libgdk_pixbuf-2.0.so.0 -> libgdk_pixbuf-2.0.so.0.1600.6 -rwx--x--x 1 splunk splunk 134914 Dec 2 2011 libgdk_pixbuf-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 34 Jul 9 18:40 libgdk_pixbuf_xlib-2.0.so -> libgdk_pixbuf_xlib-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 34 Jul 9 18:40 libgdk_pixbuf_xlib-2.0.so.0 -> libgdk_pixbuf_xlib-2.0.so.0.1600.6 -rwx--x--x 1 splunk splunk 73633 Dec 2 2011 libgdk_pixbuf_xlib-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 22 Jul 9 18:40 libgio-2.0.so -> libgio-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 22 Jul 9 18:40 libgio-2.0.so.0 -> libgio-2.0.so.0.2200.4 -rwx--x--x 1 splunk splunk 879905 Dec 2 2011 libgio-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 23 Jul 9 18:40 libglib-2.0.so -> libglib-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 23 Jul 9 18:40 libglib-2.0.so.0 -> libglib-2.0.so.0.2200.4 -rwx--x--x 1 splunk splunk 1133178 Dec 2 2011 libglib-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgmodule-2.0.so -> libgmodule-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgmodule-2.0.so.0 -> libgmodule-2.0.so.0.2200.4 -rwx--x--x 1 splunk splunk 15859 Dec 2 2011 libgmodule-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgobject-2.0.so -> libgobject-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgobject-2.0.so.0 -> libgobject-2.0.so.0.2200.4 -rwx--x--x 1 splunk splunk 323655 Dec 2 2011 libgobject-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgthread-2.0.so -> libgthread-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgthread-2.0.so.0 -> libgthread-2.0.so.0.2200.4 -rwx--x--x 1 splunk splunk 21416 Dec 2 2011 libgthread-2.0.so.0.2200.4 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgtk-x11-2.0.so -> libgtk-x11-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 26 Jul 9 18:40 libgtk-x11-2.0.so.0 -> libgtk-x11-2.0.so.0.1600.6 -rwx--x--x 1 splunk splunk 5345862 Dec 2 2011 libgtk-x11-2.0.so.0.1600.6 lrwxrwxrwx 1 splunk splunk 19 Jul 9 18:40 libmudflap.so -> libmudflap.so.0.0.0 lrwxrwxrwx 1 splunk splunk 19 Jul 9 18:40 libmudflap.so.0 -> libmudflap.so.0.0.0 -rwx--x--x 1 splunk splunk 250225 Dec 2 2011 libmudflap.so.0.0.0 lrwxrwxrwx 1 splunk splunk 21 Jul 9 18:40 libmudflapth.so -> libmudflapth.so.0.0.0 lrwxrwxrwx 1 splunk splunk 21 Jul 9 18:40 libmudflapth.so.0 -> libmudflapth.so.0.0.0 -rwx--x--x 1 splunk splunk 260102 Dec 2 2011 libmudflapth.so.0.0.0 ... You should try to : uninstall pdfreport server check the checksum of your pdfserver.tar.gz file reinstall pdfreport server with the command tar xvzf pdfserver.tar.gz in etc/apps This worked for me. ... View more

This button doesn't exist anymore in Splunk 5. You have to use the Verbose Mode to see the auto extracted fields. By default, the Smart Mode is used in Search to optimize the performance. The difference between the modes is explained here : http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Changethesearchmode ... View more

Weird. Could you give us the result of : ls -l /opt/splunk/etc/apps/pdfserver/bin/firefox-i386/dep/lib/ ... View more

Check this post from Adrian Hall. He advices to use a lookup on all the objects where a translation is needed. The difficulty is to have a lookup file with all the fields translated into the target language. Maybe this file will be release soon by Splunk. ... View more

What is your architecture ? Do you use Universal forwarders to get the IIS logs ? Do your files appears in the TailingProcessor:FileStatus ? (check https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus) If everything is ok on the CAS servers and if you receive others events on the indexer, it means that you should check the configuration of your indexer. Do you have some nullQueue configuration in a props.conf file ? ... View more