It is awesome that they built this into version 6.2+! I tried it, but with no luck. What I would to get is the IP address of the Splunk UF associated with an event. We have a ton of events coming from cloud hosts which have artifical hostnames that we have created and assigned in the inputs.conf. So I can't use "host" value in splunk for a reverse lookup. What I really want to reveal is the ip associated with the Splunk UF agent for each event. I can see these ip addresses in the Deployment Server view but they are lost as my search head view. Any suggestions? ... View more

Is there a way to display/timechart # queued searches ? ... View more

We use the following line in the sourcetype stanza for iis in the props.conf file. SEDCMD-THROWAWAY-COMMENTS=s/^#.+[\r\n]+#.+[\r\n]+#.+[\r\n]+#.*[\r\n]//g ... View more

Me too... I tried this option "-no local true" .... and it did not do anything, after waiting hours. ... View more

Is there any way to "clean" an existing summary index that contains duplicates? ... View more

you mean this line from fill_summary_index.py , correct? dedupsearch = 'search splunk_server=local index=$index$ $namefield$="$name$" | stats count by $timefield$' ... View more

I found this ... not sure if/how it works http://devpost.com/software/splunk-elasticsearch ... View more

Can I do this and keep my header? ... View more

This is a bummer ... We have jason as part of an event. Would love to have field extraction happen under the hood, e.g. in props.conf or transforms.conf. Seems like there is a way based on postings in this thread. (?) ... View more

very nice indeed! thank you .. here is a slight modification. | REST /services/data/indexes | dedup title | sort title | table title ... View more

Is it possible to automate the spath functionality into a props.conf or transforms.conf ? the previously given REPORT and transforms.conf ... work but not to the extent of the spath command. ... View more

will this work on a search head? I would really like to apply this field extraction only at search time. ... View more

these links might help http://docs.splunk.com/Documentation/DBX/2.0.6/DeployDBX/Supporteddatabases#Supported_database_matrix https://jdbc.postgresql.org/download.html ... View more

I am seeing these to .. any updates ? 09-24-2015 05:49:35.834 -0400 INFO ArchiveProcessor - handling file=/var/cdnlog/cdn.n1.paychexinc.com_20150924003358_112706.log.gz 09-24-2015 05:49:35.834 -0400 INFO ArchiveProcessor - reading path=/var/cdnlog/cdn.n1.paychexinc.com_20150924003358_112706.log.gz (seek=0 len=863894) 09-24-2015 05:49:36.295 -0400 ERROR ArchiveContext - From archive='/var/cdnlog/cdn.n1.paychexinc.com_20150924003358_112706.log.gz': gzip: stdout: Broken pipe 09-24-2015 05:49:37.667 -0400 INFO ArchiveProcessor - Finished processing file '/var/cdnlog/cdn.n1.paychexinc.com_20150924003358_112706.log.gz', removing from stats 09-24-2015 05:49:37.667 -0400 INFO ArchiveProcessor - handling file=/var/cdnlog/cdn.paychexinc.com_20150924020241_122706.log.gz 09-24-2015 05:49:37.668 -0400 INFO ArchiveProcessor - reading path=/var/cdnlog/cdn.paychexinc.com_20150924020241_122706.log.gz (seek=0 len=53513669) 09-24-2015 05:49:37.668 -0400 WARN TcpOutputProc - The event is missing source information. Event : 09-24-2015 05:49:38.041 -0400 ERROR ArchiveContext - From archive='/var/cdnlog/cdn.paychexinc.com_20150924020241_122706.log.gz': gzip: stdout: Broken pipe ... View more

yes, we have these too ... what does it mean? ... View more

Can we assume that status=skipped is a "not" so good thing? ... View more

great question ! We have had Splunk for 2 years, I have never had anyone ask me for search results from the old-dispatch-jobs directory. So in my mind that means delete them say after a week. : - ) ... View more

Hello, I am in the same boat. Just upgraded our search heads from 6.1.4 to 6.2.2 and want to change from SHPool to SHCluster. The Splunk docs regarding migration are vague. It sounds like new splunk instances are required (?) and you migrate configs/app ... Can these be on the same host? or do I need new hosts? Help : - ) ... View more

Hi .. so we are trying to connect to a MS SQL cluster/HA instance. Any advice? ... View more

some additional information about this issue .. seems that those with admin role can see the entire fields, those that are either user or power role, can't see the entire field. The problem happens both with Oracle and MSSQL database reads. We have confirmed/set permissions for sourtype= dbmon:mkv, transforms = dbx-mkv ... View more

Thank you for the suggestion. I crafted the following search ... index=hro_prod sourcetype="dbmon:mkv" earliest="8/22/2014:07:15:00" latest="8/22/2014:07:25:00" Exception=* | eval a_len=len(Exception) | dedup a_len | table a_len when I run this (admin) I get, a_len: 57,109,214,81,184,34 ... when my user runs this same search they get a_len: 24,59,33,25,34. Very strange. They don't get the same number of events .. they also don't get the same numbers. ... View more