If I run the same search using two different time windows I consistently get different results. I'm looking to count the number of email messages sent. The search query is simple: index="linux" sourcetype="syslog" | transaction queue_id When i search for a time range of 19:00:00 to 19:30:00 I get the following results (note from 19:21 on there are zero results): If I then search for 19:21:00 to 19:22:00 I get the following results (note: now where are 245 events): ... View more

Having a bit of an issue getting the Splunk App for Web Analytics setup completed. Here's some details: Installed Splunk App for Web Analytics v1.31 on Search Head (v6.2) The 'Available host and source combinations' panel appears to be working properly. I.E. I see the host(s) and sources I care about listed. The 'Setup new website' panel appears to be working properly. I.E. After adding a site it is listed in the 'Configured websites' panel and is added to the WA_settings.csv file. Here's an example of the wildcards I'm using: key,value,source,host site,"mysite.mydomain.com","H:\inetpub\logs\LogFiles\my-site\W3SVC**","mynode-01" I have verified the Role being used to set up the app (Admin) has the proper index listed for both 'indexes searched by default' and 'indexes'. In fact I've simply added 'All non-internal indexes' to both. The following manual searches all return results: tag="web" sourcetype="iis" source="H:\inetpub\logs\LogFiles\my-site\W3SVC*\" | tstats prestats=t count where index= by host,source | stats count AS events by host, source | search host=""* OR source=""* It seems like everything is in place, but when I go to build the lookups nothing is returned. Any help to narrow down my configuration oversight would be much appreciated. ... View more

I am attempting to enable several Windows perfmon inputs with mixed success. Inputs such as CPU, LogicalDisk, Memory, etc. all work as expected. However inputs such as .NET CLR Exceptions, .NET CLR Memory, ASP.NET, ASP.NET Applications, and Web Services don't seem to work at all. A few more details: Splunk v6.2 Remote system OS: Windows Server 2012 R2 Remote system has SplunkUniversalForwarder installed (v.6.2.1) inputs.conf is being pushed by Splunk Deployment server. Inputs.conf: # Performance Monitoring ------------------------------------------------------ [perfmon://CPU] disabled = false counters = % Processor Time; % User Time; instances = * interval = 10 object = Processor useEnglishOnly = true index = perfmon-ent-wsl [perfmon://LogicalDisk] disabled = false counters = % Free Space; Free Megabytes; % Disk Time; Avg. Disk sec/Read; Avg. Disk sec/Write; Avg. Disk sec/Transfer; Disk Reads/sec; Disk Writes/sec; instances = * interval = 10 object = LogicalDisk useEnglishOnly = true index = perfmon-ent-wsl [perfmon://Memory] disabled = false counters = % Committed Bytes In Use; Committed Bytes; Available MBytes; Page Reads/sec, Page Writes/sec; interval = 10 object = Memory useEnglishOnly = true index = perfmon-ent-wsl [perfmon://Network] disabled = false counters = Bytes Received/sec; Bytes Sent/sec; Bytes Total/sec; instances = * interval = 10 object = Network Interface useEnglishOnly = true index = perfmon-ent-wsl [perfmon://System] disabled = false counters = System Up Time; Processor Queue Length; instances = * interval = 60 object = System useEnglishOnly = true index = perfmon-ent-wsl [perfmon://.NET CLR Exceptions] disabled = false counters = # of Exceps Thrown / sec; instances = _Global_ interval = 10 object = .NET CLR Exceptions useEnglishOnly = true index = perfmon-ent-wsl [perfmon://.NET CLR Memory] disabled = false counters = # Total committed Bytes; instances = _Global_ interval = 10 object = .NET CLR Memory useEnglishOnly = true index = perfmon-ent-wsl [perfmon://ASP.NET] disabled = false counters = Application Restarts; Request Wait Time; Requests Queued; instances = * interval = 10 object = ASP.NET useEnglishOnly = true index = perfmon-ent-wsl [perfmon://ASP.NET Applications] disabled = false counters = Requests/Sec; instances = __Total__ interval = 10 object = ASP.NET Applications useEnglishOnly = true index = perfmon-ent-wsl [perfmon://Web Service] disabled = false counters = Get Requests/sec; Post Requests/sec; Current Connections; instances = _Total interval = 10 object = Web Service useEnglishOnly = true index = perfmon-ent-wsl ... View more

Splunk newbie here. I've installed the Splunk App for Windows Infrastructure to my central instance (indexer + search head) and deployed the following application to my 2008 R2 AD DCs: Splunk_TA_windows, TA-DNSServer-NT6, and TA-DomainController-NT6. Everything appears to be in order but I am not seeing some expected sources in the index. Specifically if I go to Splunk Search and Reporting > Data Summary, I see: WinEventLog:Application WinEventLog:Security WinEventLog:System Perfmon:Memory Perfmon:LocalNetwork Perfmon:FreeDiskSpace Perfmon:CPUTime some more sources... However if I enter the following search: index=winevents source="WinEventLog:DNS Server" Results are returned which confuses me because WinEventLog:DNS Server isn't listed as an indexed source. ... View more

The Splunk v4.3 spec for serverClass.conf indicates that attribute 'machineTypes' has been deprecated and the preferred attribute is 'machineTypesFilter'. However it seems that with my configuration the deprecated attribute works and the new attribute does not. I.E. Deployment app gets deployed when using the deprecated attribute versus preferred attribute. It should be noted that I am a Splunk novice. Here is a copy of my test serverClass.conf: # ----------------------------------------------------------------------------- # File name: serverclass.conf # Author: Slunk newbie # Date: 02/22/2012 16:21:55 # Keywords: configuration # Comments: # $SPLUNK_HOME/etc/system/local/serverclass.conf # ----------------------------------------------------------------------------- [global] repositoryLocation = $SPLUNK_HOME/etc/deployment-apps targetRepositoryLocation = $SPLUNK_HOME/etc/apps # Server classes -------------------------------------------------------------- [serverClass:all-searchheads] whitelist.0 = myhost.skunkworks.root.local [serverClass:all-indexers] whitelist.0 = myhost.skunkworks.root.local [serverClass:all-forwarders] blacklist.0 = vlab-mgmt-02.skunkworks.root.local whitelist.0 = * [serverClass:all-machinetypes] whitelist.0 = * [serverClass:all-adds] whitelist.0 = addc-01.root.local whitelist.1 = addc-03.skunkworks.root.local # Applications ---------------------------------------------------------------- [serverClass:all-forwarders:app:universalfwd] stateOnClient = enabled restartSplunkd = true [serverClass:all-forwarders:app:std-winevt-logs] stateOnClient = enabled restartSplunkd = true machineTypesFilter = windows-x64, windows-x86, windows-intel [serverClass:all-adds:app:ad-monitor] stateOnClient = enabled restartSplunkd = true machineTypesFilter = windows-x64, windows-x86, windows-intel ... View more