Splunk is a tool for collecting, monitoring, and analyzing log files from servers, applications, or other sources.

learn more… | top users | synonyms

0
votes
1answer
40 views

Monitoring solution that doesn't duplicate source data?

I need to analyze data stored in multiple databases. Each of them contains a few TB of logs and sensor data. If I use Splunk or ElasticSearch/Kibana, I see 2 solutions: Batch import everything ...
0
votes
1answer
61 views

Splunk disk space requirements [duplicate]

I need to get a vague idea of disk space requirements before I start forwarding logs to a Splunk instance. Each indexed line will have on average 320 characters and I will be indexing around 500,000 ...
0
votes
2answers
758 views

How Fortigate 100D send log to Splunk

I have a Fortigate 100D with FortiOS 5.06 , this is my setting config log syslogd setting set status enable set server ā€œ192.168.7.4ā€³ set reliable disable set port 515 set csv disable set facility ...
0
votes
0answers
134 views

Unable to access Splunk via port number on Ubuntu 12.04

Ubuntu 12.04 Server x64 & Splunk 6.0 I installed Splunk according to the documentation. Started Splunk as directed and I am able to see it running in the terminal. I believe I correctly added the ...
0
votes
0answers
107 views

Fail to generates a DD-WRT log to Splunk

I'm fail to generates a DD-WRT log to Splunk. While I did enable syslog and log management at DD-WRT, also specify the remote server which is abc.com:8000. Therefore, I have open the UDP port as 514 ...
1
vote
0answers
128 views

Capturing Regex in Splunk

I'm trying to grab the directory paths of GET requests and count them in Splunk using this capturing regex. index=main sourcetype="access_combined_wcookie" | rex "(?i)\"GET /(?P<MYDIR>\w+)/" | ...
0
votes
1answer
225 views

HA proxy and keepalived with Splunk search heads

Is anyone using haproxy/keepaliveD as their software load balancer in a HA search head environment? I am configuring my haproxy.cfg and having some trouble getting sticky sessions and proper load ...
1
vote
4answers
555 views

Using Puppet to incrementally add lines to a file, from multiple classes

I am trying to use Puppet to automatically configure Splunk monitoring. This involves adding a list of file paths to a Splunk configuration file (inputs.conf). Each role (webserver, db, etc.) in our ...
0
votes
1answer
179 views

Weird DF ourput in Red Hat 5.4 - Used < Size, but 0 available?

I have a server with two LUN's mounted from a local SAN. I have a configuration file in place for the vendor software we're using (splunk) that defined the size of the second LUN, but I had ...
1
vote
2answers
194 views

Alternative solution to replace aging swatch

We are using swatch installation to sort through 3-5 gig worth of networking syslog and alert us on patterns , we are using splunk to index and search the data but splunk alerting capabilities are ...
3
votes
1answer
471 views

Using the Augeas INI lens without a header

I am using the IniFile module with augeas to create a Splunk management lens. This works well for all files containing section headers like a normal INI file but there are a couple files that don't ...
0
votes
1answer
95 views

How can I import Splunk data into XpoLog?

How can I export the data into XpoLog and Index it with XpoLog Analytic module? Do I need to reindex the data or there is any migration tool for that? Thanks!
3
votes
5answers
878 views

thought on real time web analytics

we have a few web servers and am planning to create a dashboard to show the real time stats ip address,geo-location and other custom data based on database lookups. Splunk sort of fits perfectly but ...
0
votes
1answer
437 views

Getting Splunk logs from a remote location

I currently have a server in my home lab running Splunk, really love it. I'm soon going to have another server in the EC2 cloud, and I'd love to be able to monitor that using Splunk, hopefully though ...
0
votes
3answers
2k views

Splunk How do I get syslog to send data into splunk from remote machines

If I install the splunk forwarder, I can get the remote data into my splunk install, and index my logs, and searching is great. But I have a number of router devices and other devices that run syslog, ...
2
votes
2answers
496 views

How can I configure logs as data source from remote unix server in splunk?

How can I configure splunk with log files residing on remote unix servers? Normally I log into putty to a linux server, from there I ssh into another company server and I navigate through directories ...
0
votes
1answer
282 views

Using ubuntu cloud-init to setup logging to splunk

I intend to start up ~100 EC2 spot instances using Canonical's Ubuntu images. I am using multipart cloud-init user-data to setup packages, scripts, etc. I would like to know how I can tell rsyslog to ...
0
votes
1answer
477 views

Qmail - replacing multilog with splogger

I currently manage a qmail installation, set up on Centos using the qmailrocks guide (which seems to have vanished from the Internet now). So - daemontools, multilog, vpopmail, qmail. I've been asked ...
0
votes
1answer
253 views

Installing Splunk on Godaddy server

Does anyone know if it is possible to install Splunk on a Godaddy server? I've downloaded the deb file on my server using wget (and obviously I have ssh access) but I'm struggling to install it as ...
44
votes
4answers
74k views

Splunk is fantastically expensive: What are the alternatives? [duplicate]

Possible Duplicate: Alternatives to Splunk? This has been discussed, but it has been several months, so it may be time to revisit it: Earlier discussion RE Splunk alternatives For the ...
0
votes
2answers
668 views

Detect port scanning using splunk

i have setup a log server with splunk running on it. i pinged one of the clients using backtrack....Does this also genrate log which is sent the log server?????? I wanted to detect port scanning ...
0
votes
1answer
622 views

ASA5520 stops sending to splunk syslog

I have an ASA5520 that is set up to send logs to a splunk syslog server. the setup works for a while, usually around 24 hours or so, but then stops until either the logging is reconfigured (twiddling ...
2
votes
3answers
286 views

Any QUICK hints for starting off with Splunk

Just downloaded a trial of Splunk, and am thinking of using it to monitor a Windows server base, with the associated apps, e.g.: o Windows event logs / WMI queries (for Windows O/S, SQL Server, ...
2
votes
1answer
1k views

Splunk File & Directory Data Inputs

I've installed Splunk (4.1.5(85165) on windows) and have uploaded some logs without any issues. I now want to monitor a linux server, but I'm having problems adding the datasource and always get the ...
1
vote
1answer
61 views

Can I forward events from Splunk 3 to Splunk 4?

I've only used Splunk 4 before and I was wondering if setup a Splunk 3 server to forward to another Splunk 4 server. The reason I'd need to do this is because I have an old Mac OS X 10.4.11 PowerPC ...
0
votes
2answers
541 views

syslog or splunk forwarding over the internet

I have a web application that is split over a couple of sites in the US and the UK. When we have issues I would like to be able to view the collated error logs from the 2 sites. So I was thinking ...
6
votes
5answers
3k views

Would you use Splunk?

I'm watching the video at http://www.splunk.com and as someone who is newer to IT management this seems like a great solution to get me started. But I have concerns. I just moved from cPanel and I ...
10
votes
2answers
2k views

Thoughts on Free Splunk

I am considering implementing Splunk at my company but am leery about the financial investment. I noticed there is a free version of Splunk that seem to be good enough. Can anyone tell me if you are ...
1
vote
2answers
578 views

format of the log file format for splunk

The current log file name I have is: catalina.2010-02-24.log. I want to add this for splunk indexing, but i am running into problems, since there is no static file name, since everyday tomcat renames ...
0
votes
2answers
429 views

SYSLOG-NG - Having trouble with a destination

I'm trying to set up a seperate log file for all windows messages. I've set up a match for MSWinEventLog, but it's completely ignoring my configuration Here's my config, which is straight after the ...
2
votes
3answers
1k views

Running a reverse proxy in front of Splunk 4.x

So, I have previously installed Splunk 3.x behind a reverse proxy and downloaded the latest version (4.0.6 at time of typing) expecting it to be as easy to use as before. Sadly this was not the case. ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
1
vote
2answers
3k views

how to monitor web app availability with splunk?

I've recently downloaded and installed a Splunk 4.0.4 Server Enterprise trial (running on Windows Server 2008 if that matters), and now I want to set it up to monitor a few web pages in addition to ...
0
votes
2answers
2k views

Splunk: How Do I Extract Fields from W3C Extended Format

I'm trying to configure Splunk to properly parse the fields of the W3C log format. Now, I'm running into configuration confusion: where and how do I specify how to split up the log format? My ...
17
votes
4answers
2k views

Monitoring production server

Hey all, We have 3 dedicated server, splitted in several VPS using openVZ. We're using munin to monitor the VPS with the production sites, and monit on some one of the VPS to make sure it restarts the ...
1
vote
2answers
708 views

Splunk form search with multiple variables

I'm using Splunk 3.4.10 with the free license on a CentOS machine. I've created a saved form search called "Trace Mail" that I hope to use to trace a single message through my mail servers as it gets ...
12
votes
6answers
5k views

Is anybody using Splunk in a large-scale production environment?

I've been watching the videos at splunk.com and really it's hard to believe that one can get all those features for free, there's still that "where's the catch?" in the back of my head. So it'd be ...