basically I am attempting to filter wmi eventlogs before they are indexed by the splunk server, I found a topic about this but I had a few more basic questions. I'm looking at the steps for setting up forwarding to the nullque here: http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Routeandfilterdatad but im not quite understanding the directions. First step is to edit props.conf, but when I look in my directory I have multiple props.conf files. Do I need to edit all of them? If not what is the path of the file I should be editing? I found the props.conf under splunkdir/etc/system/default, is this the right one? if so this file indicated it should be placed in the etc/system/local file, should I just be copying and pasting the whole file? or just the relevant sections? same goes for the transforms.conf, which one is the correct one? thanks for the help everyone ... View more

I'm using the windows app in my splunk instance and for the moment I'm only monitoring a handful of pc's and there perfmon data. What seems to be the issue is that the hosts field doesn't update to reflect the new pc's being added. I can see the data and review it, I just cant go to the performance tab and see it in real time, and the total number of hosts is not updated on the performance tab. I checked the manual and there's very little info on this. anyone have any ideas? The data for splunk is being saved in the default directory as I have not changed this. ... View more

Hello splunk community, I'm brand new at using the software and I seem to run into a point that I cant find any documentation to cover. Basically what I'm trying to do is create a search string that pulls logons before a certain time and after a certain time, and that also pulls all logins on Saturday and Sunday. In the search manual and in the search reference I found the search terms earliestand latest, but these correspond to when the search was run, not the actual time of the log. Can anyone give me a hand with this? ... View more