Apps are normally for GUI stuff / search heads (dashboards, lookups, etc...) Add-ons are for knowledge objects, props, transforms, inputs, etc... If you were to create an add-on that only made a sourcetype CIM compliant, there would be no need for a GUI and, therefore, putting it all in one add-on would be best. If you wanted to include dashboards, putting the dashboards in an app, and the props/transforms in an add-on, would be best. The admins wouldn't have to install the GUI configs on the indexers, and you could update the two independently. ... View more

Stream doesn't support universal forwarders. You'll have to install it on a Heavy Forwarder (Splunk Enterprise, configured like a forwarder) Also, make sure you follow the setup instructions (http://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream) ... View more

Does the new indexer destination have the same index defined in indexes.conf? Also, are there any errors in splunkd.log? ... View more

You can't tell splunk to prevent a system from shutting down. However, you can run something like tail -100 /opt/splunkforwarder/var/log/splunk/metrics.log | grep queue | grep tcpout and make sure "current_size" = 0 before shutting it down. ... View more

i don't see anything, in your spl, that would actually trigger an e-mail to be sent. Have you tried appending the "sendemail" command (with the required options)? also, what would your use case be? i don't see how scheduling a search, with spl that sends and alert, would be any better than simply making a normal alert ... View more

From the Docs: Linux (RHEL/CentOS) Linux kernel version 2.6.32 or later (x86_64) Bash, version 3 or later. GNU C library (glibc.i686 32-bit). For example, install using yum install glibc.i686 PAM shared libraries (pam.i686 32-bit). For example, install using yum install pam.i686 So, no. No Windows allowed ... View more

index=os sourcetype=ps process_name!=sssd | dedup host | table host ... View more

I see it in mine. Do you have the "splunk_httpinput" app in etc/apps? ... View more

What do you mean by "purge" it? If you want to free up space while keeping some data so searches still run, you could always reduce the size of the index, in indexes.conf, with "maxTotalDataSizeMB", then restart splunk to delete the oldest data. ... View more

are you just trying to get the search string, itself? ... View more

_TCP_ROUTING should be all you need. have you tried it out, yet? ... View more

that should be it. also, those apps have lots of documentation on splunkbase ... View more

If the server you're monitoring is also the splunk server, then you should just have to change all those "disabled = 1" to "disabled = 0", for the inputs you want, and restart splunk. ... View more

that's correct ... View more

It is not, as both share some of the same ports. If the server you're monitoring is also the splunk server, then remove the universal forwarder. If your splunk server isn't the server you're monitoring, remove splunk enterprise. ... View more

I have everything installed on the one Windows server I am using, Splunk Enterprise, Universal Forwarder, Windows app for Splunk and Windows add on and selected the Windows host as the deployment server. Do you have both splunk enterprise and splunk forwarder installed on the same machine? ... View more

This usually happens when a forwarder cannot send something to an indexer. Is splunk running on your indexer? Is the input's port open? Can the forwarder connect to the input's port? ... View more

Splunk will publish the information. There's just a lot of different use cases and they don't want to publish anything before doing thorough testing. ... View more

could you expand on what "limited system resources" you're referring to? ... View more

Do I need to copy it manually to the shcluster folder? That is correct. just like /deployment-apps and /master-apps are the only ones that get pushed to forwarders/indexers, /shcluster is for apps that are pushed to search heads ... View more

what version of splunk is this? also, does the peer show as "up" in the master dashboard? ... View more

To share a dashboard, the user must have write access to the app they're trying to share it in. Assuming you're using the "search" app, simply grant users write access and they should be able to share dashboards. ... View more

Searching the time range, from a search head, then exporting the results to a mounted share might work for you. ... View more