For some reason, splunk is showing one host as two, one as DC01 (example) and dc01. Is there any way to merge them? ... View more

I have installed a universial forwarder on a windows machine and having it send to my splunk machine. The problem is that on the windows app that i have installed on the splunk server. I cant see any events, in the search app i see it like this for exampel. Running 4.2 on the server. WinEventLog:System WinEventLog:Setup WinEventLog:Security WinEventLog:Application Perfmon:Network Interface Perfmon:Free Disk Space Perfmon:CPU Load Perfmon:Available Memory ActiveDirectory ... View more

I have tried to set up a universialforwarder (first time from cli) and have it monitor some log files (/var/log/dhcpd.log for example) The packets is being send and recived (checked with tcpdump on both end) but the host in not showing up in the splunk server. What kind of stuff should i start to check on the forwarder/server? ... View more

Those of you that use splunk to monitor the dhcdp server (linux) what files should you monitor? and what settings do you use in the dhcpd config files? ... View more

Hello I want to run a search/alert that is run in a certain timespan (for example between 18:00 and 08:00) and then sends a alert. ... View more

in this manual http://www.splunk.com/base/Documentation/latest/Deploy/Extendedexampledeployseveralstandardforwarders they say that i should run this command as part of configuration. ./splunk enable listen 9997 -auth : when i do it on the machine that is supposed to work as a deployment server i get this error ./splunk enable listen 9997 -auth : Command error: The subcommand 'listen' is not valid for command 'enable'. ... View more

Say for example i have a environment that is being split into two different networks (routed through different firewalls) I have my "main" splunk server on one of the network. Is is possible to use one or more splunk instance as "collectors" on the other net and send it to the main splunk server. I rather don't want to set up routing/firewalls opening more then absolutely necessary. ... View more

Is the enterprise apps (ess,pci) included in the cost for enterprise, or do you have to buy them additionaly? ... View more

Is anyone having splunk monitoring their juniper secure access machines? And if so, can can you tell me some about how you have done it? ... View more

I have splunk installad as a lightforwarder on a windows 2k8 machine. This search source=WMI:localprocesses Name!=Total | rex field=Name "(?<Name>[^#]+)#\d+$" | eval CPULoad = PercentProcessorTime | search host="kebab01" | stats avg(CPULoad) by Name Shows that splunkds "avg(CPULoad)" is around 95%, that feels quite much, is it normal? Im running the latest version of splunk on the windows machine. ... View more

Hello I have begin try to build up splunk to use as an event handler. Ssh seemed to be a good place to start and learn, so im thinking of how to do it. As of now i was planning to create a custom dashboard that prints custom created events in realtime. Im now trying to create a event that search for a couple (3-4) of failed ssh logins on the same host in like 15 minutes. How do i count the ammount of res=failed in a event that look like this? index="os" source=/var/log/audit/audit.log res=failed | transaction host maxspan=15m Also, is this seem like a good idea to you? ... View more