I'm assuming that your second query should have HotspotName="Second" and not HotspotName="First" ? ... View more

According to what I'm seeing and reading, it appears to me that you can't do this with the default configuration. (And in fact, a netstat on the splunkd process shows that it's a single PID that owns both ports being opened - 8000 and 8089, so while they're separate logical entities, it's the same process running both.) Reading further, I found that in order for this to work, you need to run Splunk in legacy mode- which according to the documentation is not the best way to run splunk. (See http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/StartSplunk) ... View more

I don't see any specific reference to "input type=file" in the Simple XML documentation, which also doesn't seem to be what you're looking for anyway. (Using that would result in the contents of that file being uploaded when the form was submitted) So it seems to me like some form of JavaScript would be necessary. But there are a couple of issues that seem like they would cause problems with this approach. Remember that Splunk is running on a server somewhere, while the browser is being run (generally speaking) from a client. The path information for locating a file will most likely be different between the two. For example, if I select a file on my local PC named c:\log\app.log and pass that name to the server, the server isn't going to have any way of accessing that file. So while I understand what you're trying to achieve, I have a lot of doubt about it being possible. (I've learned often enough not to go so far to say it's impossible - I've been proven wrong too many times before. But I'd be real interested to see if you get a viable solution to this.) I think your best bet would be some type of client-side program that would send the data to Splunk through the API. ... View more

My thoughts with issues like this is always to start with the basics. ("When you hear hoof beats, think horses, not zebras") In this case it involves double-checking all the trivial stuff: Are your inputs defined identically for all of the directories? (When you talk about it monitoring a directory, I'm assuming there are multiple files in that directory, and so you want to ensure that your file name patterns are identical) Are there any permissions or access rights issues? (Since you're copying files - possibly with an ID different from that being used by Splunk - it's worth checking to see that the Splunk ID has the necessary rights to access all files) Are there any limits defined that might be restricting the amount of data being forwarded? (Don't ask me why I know to look for stuff like this. 🙂 ... View more

I'm not sure what you're looking for - some clarification would be helpful. Are you looking to: Monitor the storage system itself to ensure that it's working correctly? Have Splunk use the storage system to store some or all of its indexes? Monitor Windows' use of that storage system regarding the amount of space being used? Those three questions would each have a different answer. ... View more

Generally speaking, programs written to access the Splunk engine are written to interact through the Splunk REST API. There's plenty of information here regarding the API. A good place to start is link text http://docs.splunk.com/Documentation/Splunk/6.1.3/Overview/Extending Working directly with the REST API is possible, and sometimes the only way to accomplish certain tasks. But there are also a set of SDKs available that encapsulate a lot of the more intricate parts, making it easy to perform common functions. Again, there's plenty of information on this site. A good place to start for the SDKs would be: link text http://docs.splunk.com/Documentation/Splunk/6.1.3/AdvancedDev/SplunkSDKs Finally, Splunk does offer specific SDK training. I just took the class almost a month ago and found it to be invaluable. link text http://www.splunk.com/view/SP-CAAAHSH ... View more

Ok, I think I understand now. Go ahead and look at the ".state.title" string for the job object and see if that provides the detail you need. ... View more

I'm not sure I understand what you're trying to retrieve here. When a search is run (saved or otherwise), the job keeps the results for the configured period of time. see: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Aboutjobsandjobmanagement and: http://docs.splunk.com/Splexicon:Job You can retrieve those results using the job object using the SID, until the job expires. Once the job has expired, you'd have to re-run the search. So your other option would be to run the search itself by the script, and retrieve the results. In that case, you can run the search by its name. (Logically, it doesn't make sense to me to try and identify a job that has already been run just by name, since that particular search could have been run multiple times, generating different results each time.) ... View more

(Oops, markdown mangled part of my answer. The reference to jobs.dict.keys() should actually be: jobs.<double underscore>dict<double underscore>.keys() ... View more