I have a field called STATUS that is displaying two values: STATUS=In STATUS=IN I need to create a regex that would extract both the values and create a single field called Status. Is there a way to do it? There is an option [c|C] that can be used to ignore case sensitive phrases but I am unable to extract the right regex. ... View more

I would like to use Splunk App for Stream to set up monitoring on network devices. I heard that a Data collection node should be used that should have a universal forwarder package and technology add-on for Splunk App Stream installed. Also the doc refers to setup Data collector node as a listener on the network device. Could someone expand in further details how this should be accomplished? Thanks, Mohammed ... View more

I have successfully set up a jms listener, but do not see the messages being pulled by splunk. I have created the inputs via Splunk UI on the JMS database inputs. I am able to successfully authenticate with the JNDI Username and password as well as Topic/Queue Username and password. I am not sure what are the next setup procedures. Splunk is not able to pull messages from these queues. ... View more

Is there a way to ignore splunk to read certain events: Here is a sample event that needs to be ignored: _!================================================ _!** $!** PROCEDURE .. : ATXXX $!** VERSION .....: 000 $!** EXECUTION .. : 0010101 _!** $!** SESSION .... : ATXXXX $!** VERSION .... : 000 $!** EXECUTION .. : 0007861 _!** _!** PROCESS DATE : 04/04/2015 _!** _!------------------------------------------------ $!** PARAMETERS. : None _!------------------------------------------------ _!** VARIABLES I am not getting an idea of the exact transforms that is required. ... View more

Hi: I am getting the following error in Splunk on a Windows Universal Forwarder: HttpPubSubConnection - Received message for an unsubscribed channel: deploymentServer/phoneHome/default/reply/servername/1DC3F94E-3967-4C5D-B212-EB35B8E26E32 What does that mean? How do I troubleshoot this issue. Please provide your opinions on this matter. ... View more

Hi I am unable to enable monitoring on a network file share, \servername\f$\XXX\XXX on a linux server. I am adding the path as data inputs from the GUI. I had made sure that the Splunkd is running as root on the linux splunk search head server. I am getting the following error: Parameter name: Path must be absolute. I was able to test the same thing out on my Windows Search Head on version 6.1.4 version and splunkd started monitoring files from the network file share \servername\f$\XXX\XXX, but when I am trying to replicate the same thing on linux Splunk Search Head server, I get the parameter name : path must be absolute error. Please guide me if I am missing something. ... View more

Hi: I am unable to start splunk web on version 6.2.2 on RHEL 6.5. Checking prerequisites... Checking http port [8001]: open Checking mgmt port [8089]: open The Splunk web interface is at https://awspoclts21:8001 I disabled the local firewall, but in vain. Still unable to start Splunk Web. Is there something I am missing. There is nothing on the web_services.log 015-04-07 11:12:31,979 INFO [5523f3df637fb21415ec90] root:635 - CONFIG: version_label (str): 6.2.2 2015-04-07 11:12:31,979 INFO [5523f3df637fb21415ec90] root:635 - CONFIG: version_number (str): 6.2.2 2015-04-07 11:12:31,979 INFO [5523f3df637fb21415ec90] root:635 - CONFIG: x_frame_options_sameorigin (bool): True 2015-04-07 11:12:31,980 INFO [5523f3df637fb21415ec90] root:693 - DJANGO: configuring... 2015-04-07 11:12:32,122 INFO [5523f3df637fb21415ec90] root:735 - DJANGO: not starting, found no apps 2015-04-07 11:12:32,122 INFO [5523f3df637fb21415ec90] root:129 - ENGINE: Bus STARTING 2015-04-07 11:12:32,132 INFO [5523f3df637fb21415ec90] root:129 - ENGINE: Started monitor thread '_TimeoutMonitor'. 2015-04-07 11:12:32,239 INFO [5523f3df637fb21415ec90] root:129 - ENGINE: Serving on 127.0.0.1:8065 2015-04-07 11:12:32,240 INFO [5523f3df637fb21415ec90] root:129 - ENGINE: Bus STARTED 2015-04-07 11:12:32,286 INFO [5523f3e0487fb211aa1210] root:129 - ENGINE: Started monitor thread 'Monitor'. splunkd.log 04-07-2015 11:13:01.406 -0400 INFO KeyManagerLocalhost - Finished reading public key for localhost: /opt/splunk/etc/auth/distServerKeys/trusted.pem 04-07-2015 11:13:01.406 -0400 INFO KeyManagerLocalhost - Reading private key for localhost: /opt/splunk/etc/auth/distServerKeys/private.pem 04-07-2015 11:13:01.406 -0400 INFO KeyManagerLocalhost - Finished reading private key for localhost: /opt/splunk/etc/auth/distServerKeys/private.pem 04-07-2015 11:13:21.124 -0400 WARN TcpOutputProc - Cooked connection to ip=10.143.28.20:9997 timed out 04-07-2015 11:13:43.126 -0400 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.143.29.20_8089_awspoclts21.rsc.humad.com_awspoclts21_0A653A89-0248-4601-A642-A716953F5A43 04-07-2015 11:13:43.225 -0400 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.143.29.20_8089_awspoclts21.rsc.humad.com_awspoclts21_0A653A89-0248-4601-A642-A716953F5A43 04-07-2015 11:13:51.125 -0400 WARN TcpOutputProc - Cooked connection to ip=10.143.28.20:9997 timed out 04-07-2015 11:14:21.127 -0400 WARN TcpOutputProc - Cooked connection to ip=10.143.28.20:9997 timed out 04-07-2015 11:14:43.252 -0400 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.143.29.20_8089_awspoclts21.rsc.humad.com_awspoclts21_0A653A89-0248-4601-A642-A716953F5A43 04-07-2015 11:14:51.128 -0400 WARN TcpOutputProc - Cooked connection to ip=10.143.28.20:9997 timed out 04-07-2015 11:15:21.130 -0400 WARN TcpOutputProc - Cooked connection to ip=10.143.28.20:9997 timed out We can ignore the errors on splunkd.log as this is a fresh install and I am planning to add port 9997 through the web UI ... View more

I have data on a data mover that I would like Splunk to index the data. Unfortunately, we cannot setup UF on the data mover. I tried to created an inputs configuration to enable monitoring from this shared path. I am having access to this shared path as well. [monitor:\simclrdat01\FinRec\WorkSpace\DollarU\DEV\lou01\Tad\AAA MCP Approved] disabled = false index = mcp_text sourcetype = mcp_text_2 crcSalt = But it doesn't seem to be working. Please provide some inputs on how to get this working. Thanks ... View more

We are planning to upgrade our search head to version 6.2.2 before we upgrade our indexers currently on version 6.1.2. Will there be any compatibility issues. Please let me know. Thanks, ... View more

Hi I would like to upload a text file containing more than 1500 lines without any line breaks. How do I do this in Splunk? Here is my props.conf [sourcetype] MAX_EVENTS = 2000 TRUNCATE = 99999 SHOULD_LINEMERGE = TRUE DATETIME_CONFIG = CURRENT Even after making these changes, I am unable to get the data properly indexed in Splunk. I am getting line breaks. How do I properly get the events properly indexed to get the entire 1500 + lines as one event? Please let me know. Thanks ... View more