Splunk is a tool for collecting, monitoring, and analyzing log files from servers, applications, or other sources.

learn more… | top users | synonyms

1
vote
1answer
62 views

Can I forward events from Splunk 3 to Splunk 4?

I've only used Splunk 4 before and I was wondering if setup a Splunk 3 server to forward to another Splunk 4 server. The reason I'd need to do this is because I have an old Mac OS X 10.4.11 PowerPC ...
0
votes
1answer
27 views

Splunk 6: “Cannot preview on this Splunk instance”

I have a distributed Splunk 6 environment with which I am working through the installation of a new Technology Add-on. On my forwarder I am trying to add a new Data Input... Settings > Data inputs > ...
0
votes
1answer
23 views

Splunk aws:config sourcetype not showing in Splunk

I created the data input for AWSConfig by modifying inputs.conf file but I dont see sourcetype aws:config created under Splunk. The AWSConfig messages are sitting in the SQS queue which means Splunk ...
0
votes
1answer
100 views

Converting IP addresses from Hex to normal format in Splunk

How do you convert IP address data in a splunk field from HEX to the normal 4 octet format?
0
votes
1answer
436 views

JSON vs Key-Value for Splunk

Rolling out splunk I'm debating switching to JSON. Splunk supports spath now and even endorses JSON towards user friendliness (ref: http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 ) ...
0
votes
1answer
173 views

Monitoring solution that doesn't duplicate source data?

I need to analyze data stored in multiple databases. Each of them contains a few TB of logs and sensor data. If I use Splunk or ElasticSearch/Kibana, I see 2 solutions: Batch import everything ...
0
votes
1answer
373 views

HA proxy and keepalived with Splunk search heads

Is anyone using haproxy/keepaliveD as their software load balancer in a HA search head environment? I am configuring my haproxy.cfg and having some trouble getting sticky sessions and proper load ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
1
vote
0answers
26 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
0answers
250 views

Capturing Regex in Splunk

I'm trying to grab the directory paths of GET requests and count them in Splunk using this capturing regex. index=main sourcetype="access_combined_wcookie" | rex "(?i)\"GET /(?P<MYDIR>\w+)/" | ...
0
votes
0answers
77 views

Open Splunk forwarder/receiver TCP port on OpenShift

I need to open TCP port 9997 on OpenShift so Splunk is able to listen for incoming data from fowarders on other servers. I've set up Splunk using this guide: ...
0
votes
0answers
26 views

Search Head Configuration

I am trying to create a splunk enviroment with multiple instances, there will be an instance with an indexer, search head, Deployment server and a forwarder. I am struggling to get connectivity ...
0
votes
0answers
23 views

Reconstructing a session (or user-flow) in splunk

I'm trying to recreate the process that a user goes through with regards to a specific set of endpoints and I want to see the order in which these call events occur. For the time being, I can use ...
0
votes
0answers
335 views

Unable to access Splunk via port number on Ubuntu 12.04

Ubuntu 12.04 Server x64 & Splunk 6.0 I installed Splunk according to the documentation. Started Splunk as directed and I am able to see it running in the terminal. I believe I correctly added the ...