Splunk is a tool for collecting, monitoring, and analyzing log files from servers, applications, or other sources.

learn more… | top users | synonyms

1
vote
1answer
62 views

Can I forward events from Splunk 3 to Splunk 4?

I've only used Splunk 4 before and I was wondering if setup a Splunk 3 server to forward to another Splunk 4 server. The reason I'd need to do this is because I have an old Mac OS X 10.4.11 PowerPC ...
0
votes
1answer
34 views

Converting IP addresses from Hex to normal format in Splunk

How do you convert IP address data in a splunk field from HEX to the normal 4 octet format?
0
votes
1answer
202 views

JSON vs Key-Value for Splunk

Rolling out splunk I'm debating switching to JSON. Splunk supports spath now and even endorses JSON towards user friendliness (ref: http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 ) ...
0
votes
1answer
137 views

Monitoring solution that doesn't duplicate source data?

I need to analyze data stored in multiple databases. Each of them contains a few TB of logs and sensor data. If I use Splunk or ElasticSearch/Kibana, I see 2 solutions: Batch import everything ...
0
votes
1answer
310 views

HA proxy and keepalived with Splunk search heads

Is anyone using haproxy/keepaliveD as their software load balancer in a HA search head environment? I am configuring my haproxy.cfg and having some trouble getting sticky sessions and proper load ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
1
vote
0answers
213 views

Capturing Regex in Splunk

I'm trying to grab the directory paths of GET requests and count them in Splunk using this capturing regex. index=main sourcetype="access_combined_wcookie" | rex "(?i)\"GET /(?P<MYDIR>\w+)/" | ...
0
votes
0answers
9 views

Search Head Configuration

I am trying to create a splunk enviroment with multiple instances, there will be an instance with an indexer, search head, Deployment server and a forwarder. I am struggling to get connectivity ...
0
votes
0answers
16 views

Reconstructing a session (or user-flow) in splunk

I'm trying to recreate the process that a user goes through with regards to a specific set of endpoints and I want to see the order in which these call events occur. For the time being, I can use ...
0
votes
0answers
278 views

Unable to access Splunk via port number on Ubuntu 12.04

Ubuntu 12.04 Server x64 & Splunk 6.0 I installed Splunk according to the documentation. Started Splunk as directed and I am able to see it running in the terminal. I believe I correctly added the ...