Search Head Cluster, separate Indexers, separate Deployer, separate Distributed Management Console. Only issue is that DMC server role is set as "Search Head" for some reason. Technically, it is one, but I don't want to see it in the DMC overview that way. Are there any (negative) effects from removing this role from the DMC? ... View more

We currently have a standalone search head (5.0.7) with customization to the nav bar ( etc/apps/search/local/data/ui/nav/default.xml ) to help users quickly access searches and dashboards. We are building a new search head CLUSTER (6.3.3), and I do not know how to recreate this when using the deployer for the cluster. It seems it would be a simple matter of deploying the default search app with our tweaks, but the docs specifically say not to deploy default apps like search. Manually copying the file into the search app on all the cluster nodes seems backwards and would be annoying to keep up to date. What's the best way to solve this? ... View more

I've got a single v4 Splunk Indexer/Search. Feeding it are multiple Forwarders that have local indexing disabled and have all their inputs/conf deployed to them in apps. I'd like for a scheduled search on the Indexer to be able to trigger a script I've deployed on the forwarder. My limitations are that I don't want the script to run and send data continuously (which would be easy) because 99% of the time it's not relevant, and we're trying to isolate a problem that occurs sporadically. Also, our environment doesn't allow password-less (automated) logins from host-to-host, so the simple ssh solution isn't available. There's doesn't appear to be anything about this in help/answers, but I may be searching for the wrong thing. Can Splunk do this? Am I going about this the wrong way? Thanks. ... View more

I'm really frustrated and need a sanity check on what I'm doing. I've got an indexer which is deploying apps to several heavy forwarders. Each app has inputs, props and transforms for specific server type data. The inputs and props are working great, however I can't get any field extraction to show up on the indexer. One example: props.conf ------ [stellent_log] TRANSFORMS-stellent = stellent_setnull, stellent_keep *(these work)* REPORT-verbose = verbose_status REPORT-heap = heap_status TIME_FORMAT = %m.%d %H:%M:%S.%3N transforms.conf ------ [verbose_status] REGEX = Configuring tracing verbose:\s+(\w+): FORMAT = verbose_status::$1 [heap_status] REGEX = (?i)are\s+(?<heapfree>\d+)\s+free[^\d]+\s+(?<heaptotal>\d+)\s+meg I've read http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F (may not have understood this fully) Tested the regex at regexpal.com Copied the transform to $SPLUNK_HOME/etc/system/local/ to see if it was in the wrong place Extracted fields using the same regex from the WebUI which saved in $SPLUNK_HOME/etc/users/admin/search/local (worked) The only field extraction I have working is from conf files local to the indexer. Am I making a simple mistake? ... View more

I'm trying to send certain events ("IdcServerThread" stuff) to nullQueue unless there's a specific pattern in it (the "verbose:" stuff). I'm not able to perform a positive match on all the other possibilities, so I'm trying a negative lookahead. What am I doing wrong? KEEP LINE: system 10.28 18:25:05.078 IdcServerThread-24 Configuring tracing verbose: false; sections: system, indexer, requestaudit DISCARD LINE: requestaudit 10.28 18:25:01.753 IdcServerThread-23 Ending request thread leaving behind 0 active request threads props.conf [source::.../*stub/etc/log] sourcetype = stellent_log TRANSFORMS-stellent = no_stellent_verbose transforms.conf [no_stellent_verbose] REGEX = IdcServerThread-\d+\s+(?!Configuring) DEST_KEY = queue FORMAT = nullQueue ... View more