Lol, I wasn't searching with the correct words "hot / warm buckets". Thank you for the assistance! ... View more

Hi @rewritex , Could you please give a snippet of the same. On click of search icon of panels in my dashboard, the queries are running to verbose mode only, want to change it to fast mode. I am using Base search in my dashboard. Since export option is not available, trying out this scenerio, but I have a good amount of data, as such running in verbose mode is something trying to avoid. @all, please suggest some.   ... View more

Thank you for the reply. This settings area was blank but I ended up having to manually adjust the distsearch.conf file within the master server to remove the server from quarantine.  ... View more

I hate to say it, but I think that's simply not supported. https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/Systemrequirements#Considerations_regarding_Common_Internet_File_System_.28CIFS.29.2FServer_Message_Block_.28SMB.29 To wit - Only use CIFS/SMB shares for cold or frozen data (no hot or warm), and Splunk will *disable* any index it encounters with a non-physical drive letter. Sorry!  Even if this answer isn't the one you were hoping for, if it helps you can mark it accepted (feel free to sigh heavily at that time) and click the button to give a karma point for it). -Rich   ... View more

Because the link of @jkat54 doesn't work anymore: https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Migratenon-clusteredindexerstoaclusteredenvironment ... View more

Thanks for the asking. Yes, I believe I've installed and updated the add-on and configs correctly. I followed the relevant instructions from https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration. Within the auditd Splunk app, I click into the configure menu and everything is populating in there as expected. I am not ingesting TTY logs. ... View more

So it turns out this old blog post fixed my issue. https://www.splunk.com/en_us/blog/tips-and-tricks/cannot-search-based-on-an-extracted-field.html entitled "Cannot search based on an extracted field" There seems to be an issue when I try to create the extraction for MF3 and MF4 ... I created a fields.conf file within the app folder on the search head ... (ie ...\apps\MF-Servers\local\fields.conf ... and added the stanza for the fields giving issues and it worked ========== The fields.conf file: ======== [mf3] INDEXED_VALUE = False [mf4] INDEXED_VALUE = False I also found some specific field lengths so I expanded on my rex - "(^(?P<mf01>\d+\s\d+).{6}(?P<mf02>.{5}).(?P<mf02a>.{8}).(?P<mf3>.{9})(?<mf4>.).(?<mf5>.+)(?P<mf6>[0-2][0-9]:[0-9][0-9]:[0-9][0-9])$)" ... View more

Q: Do I need to worry about "ulimits" or the similar setting in the Windows environment? For Splunk core and Forwarders? Q: Do I need to modify the ulimits like feature in all of the windows components and forwarders or just the indexers? A: Ulimits is for Linux based system only. On windows system, you would want to to disable scanning of Splunk directory from the AV system if that is installed Q: I'm assuming I will be able to push the limits.conf down to the forwarders if I need to set those limits? A: limits.conf is to set the bandwidth for search commands and the thruput from Universal Forwarder. Q: I've modified the phone_home to 5 minutes. Should I expect a huge bandwidth spike in phase 1 or phase 2 A: Splunk will be able to handle the load for phase 1 and 2. The maximum I've taken it to is approx 5000 endpoints and upto 15 mins of interval. I know the recommended max is 15 mins for phone home interval. At that point, I added a new DS. Q: Any other configurations I should review to make this deployment smoother and/or not crash the gibson? A: - look at outputs.conf from the UF's and check that you've it well load balanced using both time and frequency based setting. - deploy to a much smaller set of endpoints first and ensure the right eventid's are coming through and you've blacklisted any that are not needed - the data is being parsed correctly and you've the windows TA installed across the tiers as per the installed requirements - Configure a base app, so that the right set of deployment config can be send to each of the UF's - Check this document, this way you can pack the base app, beforehand so when splunk UF is turned on the first time, it contacts the DS https://docs.splunk.com/Documentation/Forwarder/8.0.2/Forwarder/InstallaWindowsuniversalforwarderfromaZIPfile This modular approach to deploying apps will also assist with adding other config later on, such as ssl. You just create a new app with ssl config and push that out - Create the right server classes - Ensure you've the necessary inputs.conf configured in the local directory of the TA and not in default directory - Distributed search configured ... View more

You can do this by adding a <change> element to your time input. Here is an example of this where the token I'm unsetting is called "tok" <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> <change> <unset token="var"></unset> </change> </input> </fieldset> ... View more

After looking at @rewritex's comments, I'm posting this new answer. Lookups, even time-based lookups, don't (by default) enable searching by using the timepicker. Instead they are intended for a use case like the following: server_purposes.csv: start_time,host,purpose 2018-02-01,host01,all-in-one 2018-02-02,host01,searchhead 2018-02-02,host02,indexer 2018-02-03,host02,ageout-indexer 2018-02-03,host03,cluster-master 2018-02-04,host04,indexer 2018-02-04,host05,indexer 2018-02-04,host06,indexer 2018-02-05,host02,monitoring-console transforms.conf: [server_purposes] filename = server_purposes.csv time_field = start_time time_format = %Y-%m-%d search: | makeresults | eval host="host02", _time=strptime("2018-02-04", "%Y-%m-%d") | lookup server_purposes host results: host=host2 purpose=ageout-indexer However, if you have a time in your lookup file, you can somewhat fake what you may be looking for with a search like: | inputlookup server_purposes | eval _time=strptime(start_time, "%Y-%m-%d") | addinfo | where _time>=info_min_time and _time<info_max_time The addinfo command adds your earliest/latest times as chosen by the timepicker and puts them in the fields info_min_time and info_max_time , after which you can use the where command to search for _time values within that range. ... View more

Ha, he/she who's never done that, speak up now or be silent forever! 🙂 Glad you got it working. ... View more

The checksum will have changed once the data is compressed into bz2 format and therefore Splunk will read the data again...you could blacklist the files or whitelist in the inputs.conf (as per https://answers.splunk.com/answers/560579/splunk-forwarder-configuration.html#answer-560580 ) ... View more

It looks like EITHER the manifest got updated ( $SPLUNK_HOME/*-manifest ) and the other files did not, or the other way around. Either way you have a pretty failed upgrade and I check/fix all file/directory permissions and run the installation again. ... View more

Presumably, you have coldToFrozenScript or coldToFrozenDir defined to freeze your data. If you remove those attributes, data will be deleted when it ages out of cold. To not retain cold data, define a warmToColdScript for each index that simply deletes the buckets. Note that you must restart Splunk for these changes to take effect. ... View more

Just to re-iterate woodcock's point: When discussing "ignoreOlderThan" in a Splunk case: Using that attribute will cause files to be ignored even after new data has been added to them. Once the file is ignored it will always be ignored. This is not a bug. This is expected behavior for that feature. The only way to stop this is to remove that feature and restart Splunk. Thank you, Splunk Support I would avoid the use of that attribute where possible, as restarting a Splunk forwarder is the only way I know of to reset the ignore property... ... View more

Yea, that seemed to do it ... Thank You. I can't recall why it was added ... Management Console (Master) -> Settings (on the green bar not the top black bar) -> General Setup 1) Edit Actions on the Master 2) Edit Server Roles 2) remove indexer role ... View more

I have reposted my question here (changed the question a little bit): https://answers.splunk.com/answers/513490/how-to-extract-desired-information-from-transactio.html?minQuestionBodyLength=80 Can I close this question? ... View more

Hi @audrey2007, thank you for taking the time to come back to me with this. It works perfectly. Regards Chris ... View more

Types of Splunk Deployments Index Clustering - Tons of info/links that branch into more info all over this page Things I wish I knew then - This has some useful all around info Decide on FIPS before starting the upgrade/migration The toughest part for me was when I upgraded to an indexer cluster, I wasn't able to bring over the indexed data from the stand alone. There is a complex option of renaming bucket GUIDs to match the new GUIDs structure but I didn't go that route. I was able to search the standalone from the new SH but once I turned off the old Splunk I lost the data. Oh and create a deployment plan filling in all of your decision points and formula/values/IPs/IndexNames/Forwarders/etc, pass4symkey and other items .. this was invaluable. Good Luck! ... View more