Michael Wilde's Page

When Splunk indexes, by default is going to take the hostname/ip that exists directly in the logfile entry...

Often, you would like to have the IP address resolved to a hostname, or vice versa. With Splunk 4.0 came a cool feature called "Lookups". Lookups allow for the… Continue

As you know, there is a License pane in Splunk Manager (admin interface) that lets you know your "peak daily volume", and that figure is compared against your license volume. (free, or enterprise)

In the Splunk search app, (as of version 4.0.5) there is an "Index Activity" status dashboard in the search app (http://yoursplunkserver:8000/en-US/app/search/index_status). It does give you more information such as:

• Top five sourcetypes (by total KB indexed) in the last 24 hours


• In

… Continue

Recently, I've seen a number of folks who have been trying to use the Splunk for Blue Coat Proxy SG app and the proxy together so the logs come in to Splunk and they are displayed properly in Splunk.

Check out this guide, I hope it helps!

Big props go out to SplunkNinja… Continue

I spend a great deal of time using, learning and demonstrating Splunk, and recently I had some questions from users on "what can I do with fields?", "how do i make them?", "how do I tweak them?". That inspired me to publish a new Splunk Ninja episode known as "Fields of Dreams".

In this episode, Splunk Ninja gives an all out tour of "fields" in Splunk 4.0, how they work, how to use them, some tips and tricks as well.

The ability for Splunk to handle multiple data formats all in a single search… Continue

I'm working on a challenge with some "sendmail_syslog" data. Those are the logs generated by a sendmail mailer daemon. The log format looks like this:

Aug 23 11:42:59 splunk3 sendmail[1394]: n7NIgqtH001374: to=spamme@splunkit.com,
delay=00:00:04, xdelay=00:00:00, mailer=local, pri=30405, dsn=2.0.0, stat=Sent


When you index this type of data with Splunk it reads it just fine (as it does all text data). Conveniently, the search-time field extraction magic also takes those "key=value" pai… Continue