Splunk is a tool for collecting, monitoring, and analyzing log files from servers, applications, or other sources.

learn more… | top users | synonyms

1
vote
1answer
62 views

Can I forward events from Splunk 3 to Splunk 4?

I've only used Splunk 4 before and I was wondering if setup a Splunk 3 server to forward to another Splunk 4 server. The reason I'd need to do this is because I have an old Mac OS X 10.4.11 PowerPC ...
0
votes
1answer
18 views

Dumping Splunk Events

We have a nagios instance set up so that using MK-Livestatus and splunk, we are able to push all of nagios's alerts through livestatus's socket thanks to a call from splunk. However, splunk is now ...
0
votes
1answer
31 views

Splunk 6: “Cannot preview on this Splunk instance”

I have a distributed Splunk 6 environment with which I am working through the installation of a new Technology Add-on. On my forwarder I am trying to add a new Data Input... Settings > Data inputs > ...
0
votes
1answer
28 views

Splunk aws:config sourcetype not showing in Splunk

I created the data input for AWSConfig by modifying inputs.conf file but I dont see sourcetype aws:config created under Splunk. The AWSConfig messages are sitting in the SQS queue which means Splunk ...
0
votes
1answer
136 views

Converting IP addresses from Hex to normal format in Splunk

How do you convert IP address data in a splunk field from HEX to the normal 4 octet format?
0
votes
1answer
636 views

JSON vs Key-Value for Splunk

Rolling out splunk I'm debating switching to JSON. Splunk supports spath now and even endorses JSON towards user friendliness (ref: http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 ) ...
0
votes
1answer
210 views

Monitoring solution that doesn't duplicate source data?

I need to analyze data stored in multiple databases. Each of them contains a few TB of logs and sensor data. If I use Splunk or ElasticSearch/Kibana, I see 2 solutions: Batch import everything ...
0
votes
1answer
412 views

HA proxy and keepalived with Splunk search heads

Is anyone using haproxy/keepaliveD as their software load balancer in a HA search head environment? I am configuring my haproxy.cfg and having some trouble getting sticky sessions and proper load ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
1
vote
0answers
105 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
0answers
285 views

Capturing Regex in Splunk

I'm trying to grab the directory paths of GET requests and count them in Splunk using this capturing regex. index=main sourcetype="access_combined_wcookie" | rex "(?i)\"GET /(?P<MYDIR>\w+)/" | ...
0
votes
0answers
122 views

Open Splunk forwarder/receiver TCP port on OpenShift

I need to open TCP port 9997 on OpenShift so Splunk is able to listen for incoming data from fowarders on other servers. I've set up Splunk using this guide: http://www.kelvinism.com/2013/11/free-...
0
votes
0answers
33 views

Search Head Configuration

I am trying to create a splunk enviroment with multiple instances, there will be an instance with an indexer, search head, Deployment server and a forwarder. I am struggling to get connectivity ...
0
votes
0answers
392 views

Unable to access Splunk via port number on Ubuntu 12.04

Ubuntu 12.04 Server x64 & Splunk 6.0 I installed Splunk according to the documentation. Started Splunk as directed and I am able to see it running in the terminal. I believe I correctly added the ...