SplunkTalk - (AAC) http://splunk.tv Splunk Talk is a weekly show about where we answer questions sent in by listeners and collected from various forums. Visit Splunk.TV to subscribe or listen live every friday at 11AM Central Time. To be a part of the show and submit a question, please email splunktalk@splunk.com. Splunk Talk is hosted by Michael Wilde (Splunk Ninja), Jeffery Blake and Eric "Maverick" Garner. Feeder 2.2.5(1573); Mac OS X Version 10.7.2 (Build 11C74) http://reinventedsoftware.com/feeder/ http://blogs.law.harvard.edu/tech/rss en Sat, 07 Jan 2012 23:44:09 -0600 Sat, 07 Jan 2012 23:44:09 -0600 http://splunk.tv/splunktalk-podcast-logo144.png SplunkTalk http://splunk.tv 144 144 Splunk Talk is a weekly show about where we answer questions sent in by listeners and collected from various forums. Splunk Splunk Talk is a weekly show about where we answer questions sent in by listeners and collected from various forums. Visit Splunk.TV to subscribe or listen live every friday at 11AM Central Time. To be a part of the show and submit a question email splunktalk@splunk.com. Splunk Talk is hosted by Michael Wilde (Splunk Ninja), Jeffery Blake and Eric "Maverick" Garner. splunk, technology clean Michael Wilde michaelwilde@gmail.com no SplunkTalk - #62 - Going off the Rails Today's SplunkTalk is a chat about a few recent experiences with folks we've been helping. First up, I was working with someone who had a production Rails app and had some challenges getting a universal forwarder to work. They weren't aware that the Splunk Command Line Interface (CLI) is a great way to make changes to the forwarder without monkeying around with config files such as "outputs.conf". "splunk add forward-server" and "splunk list forward-server" are two of my favorite. Fast, easy, reliable. Next up, adding data. Editing inputs.conf? Bah Humbug! use "splunk add monitor (file/directory)". No restarts needed! But sometimes how and where splunk stores user created objects (inputs, searches, fields) is unclear--we cover that in this week chat as well. Maverick spawns a discussion on "files that look the same in the first few lines", some challenges, how to see what splunk is doing while its eating, and a bit of a reveal on how Splunk works. Did you know there was a "Splunk for Ruby on Rails" created with the help of John Berry (Lumos Labs) and Simeon Yep (Splunk)? Some other new apps appears on Splunk Base as well (SiteScope Health, RSA SecureID, Splunk Mobile). Big shout out to SplunkTalk listener William Che at ABC!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 30 Dec 2011 10:24:29 -0600 06044E40-45FD-4214-B4A2-05FD501A5F29 Splunk Today's SplunkTalk is a chat about a few recent experiences with folks we've been helping. First up, I was working with someone who had a production Rails app and had some challenges getting a universal forwarder to work. They weren't aware that the Splunk Command Line Interface (CLI) is a great way to make changes to the forwarder without monkeying around with config files such as "outputs.conf". "splunk add forward-server" and "splunk list forward-server" are two of my favorite. Fast, easy, reliable. Next up, adding data. Editing inputs.conf? Bah Humbug! use "splunk add monitor (file/directory)". No restarts needed! But sometimes how and where splunk stores user created objects (inputs, searches, fields) is unclear--we cover that in this week chat as well. Maverick spawns a discussion on "files that look the same in the first few lines", some challenges, how to see what splunk is doing while its eating, and a bit of a reveal on how Splunk works. Did you know there was a "Splunk for Ruby on Rails" created with the help of John Berry (Lumos Labs) and Simeon Yep (Splunk)? Some other new apps appears on Splunk Base as well (SiteScope Health, RSA SecureID, Splunk Mobile). Big shout out to SplunkTalk listener William Che at ABC! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 24:24 SplunkTalk - #61 - Game, Set, Match So there are 80+ search commands. Every so often we run across one we've never used. This week, "we" is Wilde. Maverick holds a CLINIC on the "set" search command. Not so fast, listener/reader--we're not talking about setting a variable or field (Which you can do with "veal"). This is more about working with two "sets" of results and looking for differences, union, intersection to use them to make some interesting decisions about your data. Rumor has it there's a "Splunk Book" being written. Wilde is gaga about Splunk 4.3 (coming soon!). Maverick hosted the inaugural Dallas Splunk Users Group. One user has 32 indexers. Yeah. THIRTY TWO INDEXERS. Like a boss!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 04 Dec 2011 22:16:14 -0600 89993D07-1B7A-4968-9BB8-3EA250D2F3C8 Splunk So there are 80+ search commands. Every so often we run across one we've never used. This week, "we" is Wilde. Maverick holds a CLINIC on the "set" search command. Not so fast, listener/reader--we're not talking about setting a variable or field (Which you can do with "veal"). This is more about working with two "sets" of results and looking for differences, union, intersection to use them to make some interesting decisions about your data. Rumor has it there's a "Splunk Book" being written. Wilde is gaga about Splunk 4.3 (coming soon!). Maverick hosted the inaugural Dallas Splunk Users Group. One user has 32 indexers. Yeah. THIRTY TWO INDEXERS. Like a boss! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 28:37 SplunkTalk - #60 - Diamonds in the rough When you hit sixty, isn't that time for a mid-life crisis? Perhaps, but not this crew. We've been SplunkTalk'in for sixty episodes now. One might say its our "diamond anniversary". Why not. This week we've got a few questions for ya and some learning even mid-episode. Splunk Ninja answers a question that new users might have around re-enabling the web interface on a "light or heavy" forwarder. Maverick answers a really neat question around reporting on top 5 daily java exceptions and how to dynamically generate dashboard panels--and Wilde learns about the "accum" search command in the context of Mav's answer. In the "What did we learn this week" segment, Ninja discusses a bit about the forthcoming MySQL lookup plugin to make massive lookup tables more scalable than CSV's in the context of an interesting use case. You'll just have to press play!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 21 Nov 2011 00:04:53 -0600 66695F7F-4611-4554-A20B-DC16AFAAD175 Splunk splunk clean 29:02 SplunkTalk - #59 - Schooled by the n00b Greetings friends! Its time for another cozy chat with (maybe) your favorite nerds, Maverick Garner and Michael Wilde, the Splunk Ninja. On this week's episode we have a chat about using Splunk's Deployment Monitor app to take a gander at nodes not reporting in when you hope them to be. Setting up alerts might be the answer--perhaps? Maverick answers a question on access control based on information in a lookup (which may not be totally possible) but the discussion is interesting. The real fun part about this episode is in the title "Schooled by the n00b". One of our favorite Splunker's supern00b Jesse Miller schools us by teaching Wilde a little thing about field extraction. Jesse's not really a n00b anymore--after all he's been at Splunk for 7 months and rocks!!!! Simon Shelston wrote a sweet blog post about how to detect anonymous proxies hitting your servers. We highly recommend you check this out as the technique is quite good!. We're looking for feedback on how to make the Splunk community much better. Feedback please!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 07 Nov 2011 21:51:41 -0600 80B44751-2E1D-435E-8B37-639A22339EB8 Splunk Greetings friends! Its time for another cozy chat with (maybe) your favorite nerds, Maverick Garner and Michael Wilde, the Splunk Ninja. On this week's episode we have a chat about using Splunk's Deployment Monitor app to take a gander at nodes not reporting in when you hope them to be. Setting up alerts might be the answer--perhaps? Maverick answers a question on access control based on information in a lookup (which may not be totally possible) but the discussion is interesting. The real fun part about this episode is in the title "Schooled by the n00b". One of our favorite Splunker's supern00b Jesse Miller schools us by teaching Wilde a little thing about field extraction. Jesse's not really a n00b anymore--after all he's been at Splunk for 7 months and rocks!!!! Simon Shelston wrote a sweet blog post about how to detect anonymous proxies hitting your servers. We highly recommend you check this out as the technique is quite good!. We're looking for feedback on how to make the Splunk community much better. Feedback please! splunk clean 30:23 SplunkTalk - #58 - Back in the saddle! Greetings to all fine feathered SplunkTalk listeners. Maverick and SplunkNinja are back in the saddle again. A few vacations, user conference, travel and other stuff has kept us from releasing some episodes--but thats all in the past now. Episode 58 returns to our traditional Q&A format. On the docket for this episode is a discussion around disk sizing, I/O (IOPS), disk performance and some recommendations on storage. Wilde asks Maverick a question on High CPU usage on Splunk startup due to massive file monitoring and some recommendations on dealing with that challenge. In our "what did we learn this week" segment, Wilde learned about a really cool OS X app called "FlashFrozen" that monitors the Flash process and warns/kills when it gets over 30% CPU usage--a.k.a (CPU Low Power Mode). All sorts of nerdy Splunky stuff including outputlookup, xpath, xmlunescape and the usual ridiculousness is back on schedule!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Thu, 20 Oct 2011 09:52:00 -0500 36D775C0-5130-40E6-B89A-F490EBF16E71 Splunk Greetings to all fine feathered SplunkTalk listeners. Maverick and SplunkNinja are back in the saddle again. A few vacations, user conference, travel and other stuff has kept us from releasing some episodes--but thats all in the past now. Episode 58 returns to our traditional Q&A format. On the docket for this episode is a discussion around disk sizing, I/O (IOPS), disk performance and some recommendations on storage. Wilde asks Maverick a question on High CPU usage on Splunk startup due to massive file monitoring and some recommendations on dealing with that challenge. In our "what did we learn this week" segment, Wilde learned about a really cool OS X app called "FlashFrozen" that monitors the Flash process and warns/kills when it gets over 30% CPU usage--a.k.a (CPU Low Power Mode). All sorts of nerdy Splunky stuff including outputlookup, xpath, xmlunescape and the usual ridiculousness is back on schedule! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 31:54 SplunkTalk - #57 - User Conference 2011 - Day 2 - Sending out an S.o.S From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview two epic Support Splunkers Octavio DiScuillo and Mick Shanaghy. Always a hoot, Mick and Octavio give us a great overview on the Splunk on Splunk or "S.o.S" app available on SplunkBase.com right now. S.o.S is an app that our support team built to help diagnose issues in your splunk deployment. Now, you get to have that very tool. I love it!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 09 Sep 2011 10:20:44 -0500 8C7F7C1B-B75A-47ED-813A-7986A005EDF2 Splunk From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview two epic Support Splunkers Octavio DiScuillo and Mick Shanaghy. Always a hoot, Mick and Octavio give us a great overview on the Splunk on Splunk or "S.o.S" app available on SplunkBase.com right now. S.o.S is an app that our support team built to help diagnose issues in your splunk deployment. Now, you get to have that very tool. I love it! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 18:39 SplunkTalk - #56 - User Conference 2011 - Day 2 - The Blake and Sparky Show From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with founding SplunkTalk personality Jeff Blake and his buddy Sparky from Splunk Partner Forsythe. With the original three (Wilde, Maverick & Blake) and anyone name Sparky is guaranteed to be an awesome time.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 09 Sep 2011 10:20:44 -0500 18FD13BD-505E-4A81-A5E9-D0B7AA0C9111 Splunk From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with founding SplunkTalk personality Jeff Blake and his buddy Sparky from Splunk Partner Forsythe. With the original three (Wilde, Maverick & Blake) and anyone name Sparky is guaranteed to be an awesome time. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 22:17 SplunkTalk - #55 - User Conference 2011 - Day 2 - Nick Mealy From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with "original Splunker" Nick Mealy. Nick is primarily responsible for everything you see in Splunk. While at splunk, he pretty much engineered most of the user interface from 1.0 to 4.2. Nick is truly a ninja when it comes to stuff that gets painted in a web browser. Nick's newest venture is "Sideview". A company dedicated to building business-level Splunk apps. Nick shares history, perspective and some interesting conversation around some of his latest apps! Bow down to theMealy!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 09 Sep 2011 10:20:44 -0500 7C6C815E-AA34-471C-B695-356BC7858173 Splunk From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with "original Splunker" Nick Mealy. Nick is primarily responsible for everything you see in Splunk. While at splunk, he pretty much engineered most of the user interface from 1.0 to 4.2. Nick is truly a ninja when it comes to stuff that gets painted in a web browser. Nick's newest venture is "Sideview". A company dedicated to building business-level Splunk apps. Nick shares history, perspective and some interesting conversation around some of his latest apps! Bow down to theMealy! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 14:53 SplunkTalk - #54 - User Conference 2011 - Day 2 - Mark Frost From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with Splunk Customer Mark Frost. Mark's been listening to SplunkTalk for a while now. He always has great suggestions for us. Mark gives his take on Splunk's User Conference and the challenges around being a Splunk champion internally. Mark is the best!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 09 Sep 2011 10:20:44 -0500 762A2800-D2C0-4A95-876D-D5026AAD0B9A Splunk From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with Splunk Customer Mark Frost. Mark's been listening to SplunkTalk for a while now. He always has great suggestions for us. Mark gives his take on Splunk's User Conference and the challenges around being a Splunk champion internally. Mark is the best! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 22:17 SplunkTalk - #53 - User Conference 2011 - Day 2 - Jim Sherlock From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with Splunk Customer Jim Sherlock from Pearson Education. Jim is a loyal SplunkTalk listener and even recalls certain states he was flying over when listening--now that's dedication!. Jim gives his take on Fried Butter, Splunk's User Conference, and some interesting tidbits about his experience as a customer. Jim sure was a fun interview and a great guy!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 09 Sep 2011 10:20:44 -0500 543F004E-70C9-4C80-A528-B0AE2793CD18 Splunk From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with Splunk Customer Jim Sherlock from Pearson Education. Jim is a loyal SplunkTalk listener and even recalls certain states he was flying over when listening--now that's dedication!. Jim gives his take on Fried Butter, Splunk's User Conference, and some interesting tidbits about his experience as a customer. Jim sure was a fun interview and a great guy! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 18:06 SplunkTalk - #52 - User Conference 2011 - Day 1 - Intuit Interns From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with Splunk Client Architect Vi Ly, one of Splunk's most excellent customer advocates. Vi brings with her two summer interns, Peter and Emily from Splunk customer Intuit. These two University of Wisconsin Badgers had no Splunk training and did some amazing things over the summer with our product. Listen and learn!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 09 Sep 2011 10:01:13 -0500 9DD6E8BB-FB7B-4E86-855D-BA9838512B80 Splunk From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with Splunk Client Architect Vi Ly, one of Splunk's most excellent customer advocates. Vi brings with her two summer interns, Peter and Emily from Splunk customer Intuit. These two University of Wisconsin Badgers had no Splunk training and did some amazing things over the summer with our product. Listen and learn! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 18:13 SplunkTalk - #51 - User Conference 2011 - Day 1 - Rick Nutter - Dan Goldburt From a series of live on camera interviews at Splunk's User Conference 2011 comes an interview with Dan Goldburt, Splunk's Application Management Solutions Product Manager. Also featured is Splunk Customer Apollo Group's Rick Nutter giving their opinions on user conference, whats coming in the Transaction Profiling app, and Rick's experience with Splunk as a customer.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Fri, 09 Sep 2011 09:49:46 -0500 C6E27292-F8A8-40BC-BCA2-98FCA6FAE856 Splunk splunk clean 15:35 SplunkTalk - #50 - The Letter "L" is for... Wooo-hooo! The fiftieth episode of SplunkTalk! (are we half way to syndication?) probably not, but we have been at it more than most podcasters. Maverick and Wilde really enjoy our weekly nerd session about our favorite engine for machine data. Episode 50 is no departure. We have some good discussion today around . Splunk Ninja starts out with an interesting question around measuring change in metrics using the "delta" search command. Maverick offers advice to a user who's looking to migrate two Splunk indexers in to one and discusses a few concerns to be aware of. Wilde and Jesse Miller learned this week about now to properly capture field data out of Team Fortress game servers using regex and mvindex. Oh… one more thing! The "Letter L" is the Roman numeral for "50"--as in our 50th SplunKTalk Episode. Cute title, isn't it.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Fri, 12 Aug 2011 12:39:23 -0500 AB75E3FA-0B78-42D8-B804-B8B539678DD3 Splunk Wooo-hooo! The fiftieth episode of SplunkTalk! (are we half way to syndication?) probably not, but we have been at it more than most podcasters. Maverick and Wilde really enjoy our weekly nerd session about our favorite engine for machine data. Episode 50 is no departure. We have some good discussion today around . Splunk Ninja starts out with an interesting question around measuring change in metrics using the "delta" search command. Maverick offers advice to a user who's looking to migrate two Splunk indexers in to one and discusses a few concerns to be aware of. Wilde and Jesse Miller learned this week about now to properly capture field data out of Team Fortress game servers using regex and mvindex. Oh… one more thing! The "Letter L" is the Roman numeral for "50"--as in our 50th SplunKTalk Episode. Cute title, isn't it. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! Enjoy Listening! splunk clean 25:00 SplunkTalk - #49 - A SAD Day Whats so SAD about today? Its Systems Administrator appreciation Day!. That day we all give thanks to those who "keep sh*t running for us". Today we've got an episode full of content. Wilde answers a question about Apache Log Format's gone wild and how to adjust the field extraction patterns in Splunk. Maverick discusses a really cool way to get around the "50 lines limit" in a dashboard table when printing as a PDF. (is there a limit? yep -- listen to the workaround before you get hit by this one).

Big time hot stuff coming up at Splunk's User Conference 2011. Splunk Ninja's got a session going called "Field Extractions: Making Regex Your Buddy" and Maverick's doing his "Splunking Outside the Box" sessions, both of which are at 3pm on Wednesday, August 17. Which one will you attend?!.

Cool Stuff this week: We love Mike Langhorst from CalISO, New improvements in the Search Assistant are coming, and listener Kyle Smith Splunked the Tour de France. Sounds like a tour de force this week!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Mon, 01 Aug 2011 00:23:01 -0500 A1F181CA-F838-4E57-AA17-6CE51250C49D Splunk Whats so SAD about today? Its Systems Administrator appreciation Day!. That day we all give thanks to those who "keep sh*t running for us". Today we've got an episode full of content. Wilde answers a question about Apache Log Format's gone wild and how to adjust the field extraction patterns in Splunk. Maverick discusses a really cool way to get around the "50 lines limit" in a dashboard table when printing as a PDF. (is there a limit? yep -- listen to the workaround before you get hit by this one). Big time hot stuff coming up at Splunk's User Conference 2011. Splunk Ninja's got a session going called "Field Extractions: Making Regex Your Buddy" and Maverick's doing his "Splunking Outside the Box" sessions, both of which are at 3pm on Wednesday, August 17. Which one will you attend?!. Cool Stuff this week: We loveMike Langhorst from CalISO, New improvements in the Search Assistant are coming, and listener Kyle Smith Splunked the Tour de France. Sounds like a tour de force this week! splunk clean 29:37 SplunkTalk - #48 - You've been boned An episode about BBQ? A risqué' title? Nawwwww! While today's episode does cover a bit of Splunk lore regarding a certain "bone" that has made its way around Splunk's offices for a number of years--today's questions center around creating a repeating REGEX that will extract fields out of a multiline event as they appear a variable number of times. (WOW -- All that in one breath!!). Wilde has a question for Maverick about how to calculate accumulating statistics in search results using streamstats and eventstats. We've also learned that Splunker Vincent Bumgarner coded up a JDBC database query data input available on SplunkBase that will let you scrape info out of a database and eat it with Splunk! Wilde has discovered that "splunk add oneshot" now has a "rename-source" option. Check it out baby!!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Mon, 25 Jul 2011 11:16:33 -0500 C6C4843D-1712-4403-9AB6-BDF932812FA4 Splunk An episode about BBQ? A risqué' title? Nawwwww! While today's episode does cover a bit of Splunk lore regarding a certain "bone" that has made its way around Splunk's offices for a number of years--today's questions center around creating a repeating REGEX that will extract fields out of a multiline event as they appear a variable number of times. (WOW -- All that in one breath!!). Wilde has a question for Maverick about how to calculate accumulating statistics in search results using streamstats and eventstats. We've also learned that Splunker Vincent Bumgarner coded up a JDBC database query data input available on SplunkBase that will let you scrape info out of a database and eat it with Splunk! Wilde has discovered that "splunk add oneshot" now has a "rename-source" option. Check it out baby!! splunk clean 26:23 SplunkTalk - #47 - Low and Slow Ever had a low and slow attack happen? (If you aren't sure, you probably have.) Episode 47 brings us a discussion sparked by a super-smart Splunk user who was looking for advice on how to deal with, detect, and be alerted on a "low and slow" attack. The "Global Threat Landscape/IP Watchlist" app on SplunkBase, developed by Dave Croteau and Nimish Doshi of Splunk has been updated with some sweet new features--check it out! Wilde led the first ever "Splunk User's Group in Austin, TX" held at National Instruments on June 20 and provides a post-game analysis of that BBQ filled event. Reminder, Splunk User's conference is coming up and we will be podcasting from the show, so if you're in town, stop by and hang with the SplunkTalk crew.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Fri, 15 Jul 2011 02:31:09 -0500 DDCF5518-1D5B-4553-B59D-B1010D73FDBE Splunk Ever had a low and slow attack happen? (If you aren't sure, you probably have.) Episode 47 brings us a discussion sparked by a super-smart Splunk user who was looking for advice on how to deal with, detect, and be alerted on a "low and slow" attack. The Global Threat Landscape/IP Watchlist" app on SplunkBase, developed by Dave Croteau and Nimish Doshi of Splunk has been updated with some sweet new features--check it out! Wilde led the first ever "Splunk User's Group in Austin, TX" held at National Instruments on June 20 and provides a post-game analysis of that BBQ filled event. Reminder, Splunk User's conference is coming up and we will be podcasting from the show, so if you're in town, stop by and hang with the SplunkTalk crew. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! Enjoy Listening! splunk clean 32:56 SplunkTalk - #46 - Multiple Values of Love The big focus of today's episode is on multi-value fields. Boring! Not so fast buddy!, Wilde's got a really cool question about getting accurate counts of failed authentication in Windows 2008 Security Event Logs (ensuring machine names aren't counted). What? Yeah! We'll cover using "mvindex", "coalesce", and "mvcount" to do some really cool field manipulation for a couple of cool use cases. Action packed, fun-filled, and never lacking technical stuff, episode 46 delivers. pizzas.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Mon, 11 Jul 2011 02:36:29 -0500 229CDE37-9473-4FA2-9CA5-5E331241C482 Splunk The big focus of today's episode is on multi-value fields. Boring! Not so fast buddy!, Wilde's got a really cool question about getting accurate counts of failed authentication in Windows 2008 Security Event Logs (ensuring machine names aren't counted). What? Yeah! We'll cover using "mvindex", "coalesce", and "mvcount" to do some really cool field manipulation for a couple of cool use cases. Action packed, fun-filled, and never lacking technical stuff, episode 46 delivers. pizzas. splunk clean 31:12 SplunkTalk - #45 - A bug or not a bug? This episode is like one giant "What did we learn this week" segment. We're users too..and part of our job is to help folks get up and running (and on occasion folks throw some tough stuff at the Ninja). We chat a bit about using "subsearches" this week. Splunk Ninja was working with a user that needed to find all traffic from any user that failed login more than three times but *did not* receive an Account Lockout… Interesting, isn't it. There's a bug (we argue) when a sub search runs too long for the UI (and the UI times out). Not to worry, we deal with it on the 45th episode of SplunkTalk. Maverick relays some experiences and challenges with Splunk's Deployment Manager (server/client) service.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Mon, 04 Jul 2011 23:16:28 -0500 F46A9AAC-EF9B-4AEC-9BB7-5E95BDCDA520 Splunk This episode is like one giant "What did we learn this week" segment. We're users too..and part of our job is to help folks get up and running (and on occasion folks throw some tough stuff at the Ninja). We chat a bit about using "subsearches" this week. Splunk Ninja was working with a user that needed to find all traffic from any user that failed login more than three times but *did not* receive an Account Lockout… Interesting, isn't it. There's a bug (we argue) when a sub search runs too long for the UI (and the UI times out). Not to worry, we deal with it on the 45th episode of SplunkTalk. Maverick relays some experiences and challenges with Splunk's Deployment Manager (server/client) service. splunk clean 30:50 SplunkTalk - #44 - One year ago... Happy Birthday. For real this time. One year and 44 action packed episodes have passed since we started the SplunkTalk project. Its been a real pleasure to hang out, chat about Splunk and answer questions. The feedback has been good, you seem to like it, and thanks for listening. Most podcasts would to a "year in review"... but seriously, those are way boring. Lets stick to the script and answer some questions and share what we've learned. Maverick answers a question around Transactions, and Wilde shares something he learned about "rex" and repeating matches--which is quite cool (if you're a Splunk nerd).

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Tue, 21 Jun 2011 10:55:07 -0500 12A85484-7FB2-4CB0-8836-36841D2FF655 Splunk Happy Birthday. For real this time. One year and 44 action packed episodes have passed since we started the SplunkTalk project. Its been a real pleasure to hang out, chat about Splunk and answer questions. The feedback has been good, you seem to like it, and thanks for listening. Most podcasts would to a "year in review"... but seriously, those are way boring. Lets stick to the script and answer some questions and share what we've learned. Maverick answers a question around Transactions, and Wilde shares something he learned about "rex" and repeating matches--which is quite cool (if you're a Splunk nerd). Episodes are recorded live every Friday at 11AM Central Time - Email us at <a href="mailto:splunktalk@splunk.com">splunktalk@splunk.com</a> to ask questions and have them answered on air! Enjoy Listening! splunk clean 29:20 SplunkTalk - #43 - Chain of fools Chay-Chay-Chain... Chain of fools. Well, the title seemed clever at the time. Maverick and Wilde are chattin about some interesting stuff today. Maverick has a question around "Chaining Lookups" (i.e. -- calling one lookup after another, and how precedence is dealt with). Wilde answers a question focusing on tracking user activity across Windows Event Logs with the "transaction" command in the Splunk search language. NERD ALERT!: Wilde discovers that PROPS.CONF now has prioritization on its matching rules, and Maverick looks at some Disaster Recovery scenarios. All this... and more!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Thu, 02 Jun 2011 23:22:42 -0500 0DDE2B8E-810B-4AFF-A53D-1702EEAE24E6 Splunk Chay-Chay-Chain... Chain of fools. Well, the title seemed clever at the time. Maverick and Wilde are chattin about some interesting stuff today. Maverick has a question around "Chaining Lookups" (i.e. -- calling one lookup after another, and how precedence is dealt with). Wilde answers a question focusing on tracking user activity across Windows Event Logs with the "transaction" command in the Splunk search language. NERD ALERT!: Wilde discovers that PROPS.CONF now has prioritization on its matching rules, and Maverick looks at some Disaster Recovery scenarios. All this... and more! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 29:24 SplunkTalk - #42 - The Answer Episode 42 huh? Isn't that number kinda special? Some may know it as the answer to a particular question from a sci-fi novel. Do you? On today's SplunkTalk, Maverick and the Splunk Ninja answer a question from our good friend Paolo Prigone on Splunk's "High Availability" license. We also cover some interesting use cases with the "lookup" search command, and Wilde has discovered Angry Birds is available for free through the Chrome Web Store. Epic!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy Listening!

]]> Thu, 02 Jun 2011 23:22:42 -0500 1B326701-1FDF-4C78-8BAD-A2765F7CAB81 Splunk Episode 42 huh? Isn't that number kinda special? Some may know it as the answer to a particular question from a sci-fi novel. Do you? On today's SplunkTalk, Maverick and the Splunk Ninja answer a question from our good friend Paolo Prigone on Splunk's "High Availability" license. We also cover some interesting use cases with the "lookup" search command, and Wilde has discovered Angry Birds is available for free through the Chrome Web Store. Epic! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 26:20 SplunkTalk - #41 - All the right moves This episode has absolutely nothing to do with the Tom Cruise movie, or the song by OneRepublic. However, there is a bit of talk about moving your splunk data around if you're running out of diskspace. Maverick and SplunkNinja chat a bit about that topic along with how your server's timezone affects event display. Maverick has an interesting story about a search command called "transpose" and Wilde reminds us that the Deployment Monitor app has been upgraded--so go get it!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 27 May 2011 15:23:35 -0500 26CCCC82-4817-42E4-A64D-B83F04FE9F0D Splunk This episode has absolutely nothing to do with the Tom Cruise movie, or the song by OneRepublic. However, there is a bit of talk about moving your splunk data around if you're running out of diskspace. Maverick and SplunkNinja chat a bit about that topic along with how your server's timezone affects event display. Maverick has an interesting story about a search command called "transpose" and Wilde reminds us that the Deployment Monitor app has been upgraded--so go get it! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 34:15 SplunkTalk - #40 - Over the hill Mon, 16 May 2011 11:16:48 -0500 5DAD081B-6784-4D74-A9BF-F45F51FC343D Splunk splunk clean 25:42 SplunkTalk - #39 - Why are you being so negative? Gotcha! Despite the title of the episode, this NOT another rant show. We're happy this week and chattin' about whats NOT in your data. How to find things you're not expecting, searching for the "non-existence" of information. Particularly interesting this week is the "What we learned this week" segment--how to "audition data" and segment your indexing with the new license manager stuff and Maverick learned how to discover a sequence of events. Just listen... you'll see. We'll, not really, because you can't see us.. ok then.. just press play!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Wed, 11 May 2011 09:47:57 -0500 A6AD86E6-F0EA-4A84-82EF-BE0AC59FA8C8 Splunk Gotcha! Despite the title of the episode, this NOT another rant show. We're happy this week and chattin' about whats NOT in your data. How to find things you're not expecting, searching for the "non-existence" of information. Particularly interesting this week is the "What we learned this week" segment--how to "audition data" and segment your indexing with the new license manager stuff and Maverick learned how to discover a sequence of events. Just listen... you'll see. We'll, not really, because you can't see us.. ok then.. just press play! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 38:52 SplunkTalk - #38 - The Epic Rant Show? In the words of the late, great Harry Caray: Holy Cow! -- Two Splunker's ranting?!?! Well, mostly its Wilde. He's goin off on the software developers of the world and how design of log messages happens rarely, if ever--and how that needs to be alot better. We'd like to see F5's ASM be a bit more configurable for logging and produce a better cleaner log output (key=value pairs please!!)....and whats the deal with applications not allowing logs to be written to the filesystem? Do you have an app or systems management tool that writes its logs to a relational database? Join the rant! Let your vendor know that you need more flexibility because you'd like control over that data. Every once in a while ya just gotta get some stuff of your chest. Episode 38 delivers. We'll return to our regularly scheduled happy time next week!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sat, 30 Apr 2011 23:39:51 -0500 4A0AE1A5-50CC-43D7-B00E-B4B26C00669F Splunk In the words of the late, great Harry Caray: Holy Cow! -- Two Splunker's ranting?!?! Well, mostly its Wilde. He's goin off on the software developers of the world and how design of log messages happens rarely, if ever--and how that needs to be alot better. We'd like to see F5's ASM be a bit more configurable for logging and produce a better cleaner log output (key=value pairs please!!)....and whats the deal with applications not allowing logs to be written to the filesystem? Do you have an app or systems management tool that writes its logs to a relational database? Join the rant! Let your vendor know that you need more flexibility because you'd like control over that data. Every once in a while ya just gotta get some stuff of your chest. Episode 38 delivers. We'll return to our regularly scheduled happy time next week! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 41:12 SplunkTalk - #36 - What's new in Splunk 4.2? http://blogs.splunk.com/2011/04/19/splunktalk-36-whats-new-in-splunk-4-2/ Did ya hear? Splunk version 4.2 is out. 4.1 to 4.2 you'd think there wouldn't be that much new. Nay I say.. Nay! There is a steamin pile of great new features. Michael and Maverick have a chat and go over the major features of Splunk 4.2; covering Search Head Pooling, License Management, new UI gadgets, Real-Time Alerting, new Dashboard & Alert workflows, the Alert Manager and tons more. If you haven't upgraded, get on it!!!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Tue, 19 Apr 2011 21:09:32 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=3491 Splunk Did ya hear? Splunk version 4.2 is out. 4.1 to 4.2 you'd think there wouldn't be that much new. Nay I say.. Nay! There is a steamin pile of great new features. Michael and Maverick have a chat and go over the major features of Splunk 4.2; covering Search Head Pooling, License Management, new UI gadgets, Real-Time Alerting, new Dashboard & Alert workflows, the Alert Manager and tons more. If you haven't upgraded, get on it!!! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 32:11 SplunkTalk - #37 - Dude, check this out! Episode 37 features a little Texas fireside chat. Maverick and Wilde covered the new license management in Splunk--which might seem like the most boring thing in the world--but is actually pretty cool and very capable! W'eve found some issues with figureing out what your indexing volume is when evaluating Splunk. Wilde has an interesting story about some ugly Microsoft.NET logs that have "literal newline characters" written in to the event in text and how to use the LINE_BREAKER directive in props.conf to solve this. Guess What? Splunk's User Conference 2011 is comin up, so get registered for that, and the ninja answers a listener question about "Where did this Splunk Ninja thing come from"

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!!

]]> Fri, 22 Apr 2011 08:49:52 -0500 7F4A92D2-08C6-40ED-B5EC-6C6B1CE54D5B Splunk Episode 37 features a little Texas fireside chat. Maverick and Wilde covered the new license management in Splunk--which might seem like the most boring thing in the world--but is actually pretty cool and very capable! W'eve found some issues with figureing out what your indexing volume is when evaluating Splunk. Wilde has an interesting story about some ugly Microsoft.NET logs that have "literal newline characters" written in to the event in text and how to use the LINE_BREAKER directive in props.conf to solve this. Guess What? Splunk's User Conference 2011 is comin up, so get registered for that, and the ninja answers a listener question about "Where did this Splunk Ninja thing come from" Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 38:11 SplunkTalk - #35 - Winning with Splunk, Duh! http://blogs.splunk.com/2011/04/07/splunktalk-35-winning-with-splunk-duh/ You know we just had to throw in some Charlie Sheen soundbytes--inevitable. This week, Wilde and Maverick chat about a couple of interesting topics: How to figure out if someone "hasn't visited" your website this month (hint: its gonna take more than just a timechart). Maverick covers how to use Splunk and Microsoft SCOM together for better visibility & I hear he's learned about Canadian Health Care standards (yawn). Finally, Wilde shares a story about using Dan Gidman's "Autoscroller" JQuery Plugin to make a Splunk Dashboard--you guessed it--scroll down by itself. The excitement continues!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Thu, 07 Apr 2011 12:16:24 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=3455 Splunk You know we just had to throw in some Charlie Sheen soundbytes--inevitable. This week, Wilde and Maverick chat about a couple of interesting topics: How to figure out if someone "hasn't visited" your website this month (hint: its gonna take more than just a timechart). Maverick covers how to use Splunk and Microsoft SCOM together for better visibility & I hear he's learned about Canadian Health Care standards (yawn). Finally, Wilde shares a story about using Dan Gidman's "Autoscroller" JQuery Plugin to make a Splunk Dashboard--you guessed it--scroll down by itself. The excitement continues! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 26:06 SplunkTalk - #34 - Stats-isfaction! Episode 34 brings us a chat about statistics, when do use timechart vs. stats, what the "eventstats" search command does and a couple of other interesting topics. Wilde loves Bose customer service (And you'll hear why). Keepin it nerdy!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Tue, 29 Mar 2011 09:37:59 -0500 E4F46967-FFD3-412B-B79D-14692CB97B37 Splunk Episode 34 brings us a chat about statistics, when do use timechart vs. stats, what the "eventstats" search command does and a couple of other interesting topics. Wilde loves Bose customer service (And you'll hear why). Keepin it nerdy! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 32:22 SplunkTalk - #33 - A question of time Its about time!. Well, yeah, this episode is about time. Splunk Ninja, Maverick, & Jeff Blake answer questions about timezone rendering, keeping Splunk fast over a number of years, and changing the way time is displayed in the email alert from Splunk. And yes, the title is the name of Depeche Mode song. Maybe Wilde is showing his age (then again, isn't everything he does--public?). Perhaps. The new Unified Field Extractor app written by David Carasso of Splunk is covered as well.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Fri, 18 Mar 2011 00:00:35 -0500 DCD4C392-E45C-460C-BFAE-E476E4C21619 Splunk Its about time!. Well, yeah, this episode is about time. Splunk Ninja, Maverick, & Jeff Blake answer questions about timezone rendering, keeping Splunk fast over a number of years, and changing the way time is displayed in the email alert from Splunk. And yes, the title is the name of Depeche Mode song. Maybe Wilde is showing his age (then again, isn't everything he does--public?). Perhaps. The new Unified Field Extractor app written by David Carasso of Splunk is covered as well. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 19:31 SplunkTalk - #32 - The Texas Flood Alas our friend Jeff Blake is still missing in action. Oh well, Maverick and the Splunk Ninja roll with todays show. We'll be chatting about some Splunk 4.2 features, best practices for designing automatic key-value pair delimiters so field extraction "works automatically", some tips on the use of the transaction search command, upcoming events.. and oh yeah.. Splunk Storm--Splunk's cloud endeavor.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 07 Mar 2011 23:38:24 -0600 5EF29DE0-9AAF-42B3-9E29-1ADD3E38D21B Splunk Alas our friend Jeff Blake is still missing in action. Oh well, Maverick and the Splunk Ninja roll with todays show. We'll be chatting about some Splunk 4.2 features, best practices for designing automatic key-value pair delimiters so field extraction "works automatically", some tips on the use of the transaction search command, upcoming events.. and oh yeah.. Splunk Storm--Splunk's cloud endeavor. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 43:03 SplunkTalk - #31 - One Man Down http://blogs.splunk.com/2011/02/22/splunktalk-31-one-man-down/ Maverick and the Splunk Ninja hold down the fort. Rumor has it Jeff Blake is trying out for bass player in Social Distortion. (Perhaps Wilde made up that rumor?). On this week's episode of SplunkTalk, we discuss how Splunk handles monitoring old files that don't change, how to make Splunk look just like the CheckPoint Firewall Log Console (for those who need it), and n00b alert - Jesse Miller joins the Splunk team!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Tue, 22 Feb 2011 08:46:35 -0600 Tips &amp; Tricks http://blogs.splunk.com/p?=3303 Splunk Maverick and the Splunk Ninja hold down the fort. Rumor has it Jeff Blake is trying out for bass player in Social Distortion. (Perhaps Wilde made up that rumor?). On this week's episode of SplunkTalk, we discuss how Splunk handles monitoring old files that don't change, how to make Splunk look just like the CheckPoint Firewall Log Console (for those who need it), and n00b alert - Jesse Miller joins the Splunk team! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 23:53 SplunkTalk - #30 - The big three zero http://blogs.splunk.com/2011/02/08/splunktalk-30-the-big-three-zero/ This week brings our 30th episode of SplunkTalk. On this week's episode, Jeff Blake, Michael Wilde (the Splunk Ninja), and epic-dude Maverick Garner cover questions on gathering events over WMI from "non-domain connected" workgroup machines, versions of forwarders vs. the indexer and dealing with mapped drives and volumes in Windows. Funny stuff as always and some sneak peak of future Splunk developments.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Tue, 08 Feb 2011 16:41:20 -0600 Tips &amp; Tricks http://blogs.splunk.com/p?=3260 Splunk This week brings our 30th episode of SplunkTalk. On this week's episode, Jeff Blake, Michael Wilde (the Splunk Ninja), and epic-dude Maverick Garner cover questions on gathering events over WMI from "non-domain connected" workgroup machines, versions of forwarders vs. the indexer and dealing with mapped drives and volumes in Windows. Funny stuff as always and some sneak peak of future Splunk developments. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 26:30 SplunkTalk - #29 - The Untitled Episode http://blogs.splunk.com/2011/01/16/splunktalk-29-the-untitled-episode/ Welcome back to "another year" of SplunkTalk--truthfully, we're only been at this for 29 weeks (slightly more than 6 months)--but we're kickin' off 2011 with a nice and geeky episode. Jeff, Maverick and the Splunk Ninja, Michael Wilde take on the following questions:

1. Why do i get the "max current searches limit reached" message?
2. How do I tell when Splunk is finished eating my files?
3. How do a I remove or suppress hosts from the Search Summary Page?

Thanks for listening. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! Feedback is welcome!

]]> Sun, 16 Jan 2011 21:51:31 -0600 Tips &amp; Tricks http://blogs.splunk.com/p?=3190 Splunk Welcome back to "another year" of SplunkTalk--truthfully, we're only been at this for 29 weeks (slightly more than 6 months)--but we're kickin' off 2011 with a nice and geeky episode. Jeff, Maverick and the Splunk Ninja, Michael Wilde take on the following questions: 1. Why do i get the "max current searches limit reached" message? 2. How do I tell when Splunk is finished eating my files? 3. How do a I remove or suppress hosts from the Search Summary Page? Thanks for listening. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! Feedback is welcome! splunk clean 28:55 SplunkTalk - #28 - The Eval Underground Lair Dec 31, 2010 brings us the last episode of SplunkTalk for 2010. Instead of doing some "best of the year" edit, we decided to go with a real episode. This time, we're chatting about building a better eval. Our good friend Vi Ly provided plenty of fodder with her "That's Hot, Don't Touch It" blog post. Jeff, Michael, & Maverick share our experience with customers as Sales Engineers and give some tips on evaluating splunk--or any product for that matter. We even discuss the elephant in the room--your salesperson--and how best to work with them. Thanks for a great year and keep on Splunkin in 2011.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 02 Jan 2011 12:44:12 -0600 splunktalk-28-the-eval-underground-lair Splunk Dec 31, 2010 brings us the last episode of SplunkTalk for 2010. Instead of doing some "best of the year" edit, we decided to go with a real episode. This time, we're chatting about building a better eval. Our good friend Vi Ly provided plenty of fodder with her "That's Hot, Don't Touch It" blog post. Jeff, Michael, & Maverick share our experience with customers as Sales Engineers and give some tips on evaluating splunk--or any product for that matter. We even discuss the elephant in the room--your salesperson--and how best to work with them. Thanks for a great year and keep on Splunkin in 2011. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 39:14 SplunkTalk - #27 - Lookup Below Better late than never, this episode has been in the can for a bit (vacations, end of the year madness). This week we chat about Lookups. Whut? You can enrich your data that is already in Splunk with other sources that are not. How? Give this one a listen. Jeff Blake is in Wilde's home office, Maverick in Dallas, and the usual nerdy mayhem!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 27 Dec 2010 13:26:46 -0600 splunktalk-27-lookup-below Splunk Better late than never, this episode has been in the can for a bit (vacations, end of the year madness). This week we chat about Lookups. Whut? You can enrich your data that is already in Splunk with other sources that are not. How? Give this one a listen. Jeff Blake is in Wilde's home office, Maverick in Dallas, and the usual nerdy mayhem! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 47:31 SplunkTalk - #26 - Frozen Solid So I was watching the news this morning, and apparently the Minnesota Metrodome roof collapsed as a result of build up of "frozen stuff". In keeping with a chilly wintery theme, Episode 26 of SplunkTalk is all about cold & frozen data. Archiving, resurrecting & dealing with older data--all in a grand attempt by Michael, Jeff & Maverick to keep it interesting... we'll see! Enjoy listening!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 13 Dec 2010 12:52:31 -0600 splunktalk-26-frozen-solid Splunk So I was watching the news this morning, and apparently the Minnesota Metrodome roof collapsed as a result of build up of "frozen stuff". In keeping with a chilly wintery theme, Episode 26 of SplunkTalk is all about cold & frozen data. Archiving, resurrecting & dealing with older data--all in a grand attempt by Michael, Jeff & Maverick to keep it interesting... we'll see! Enjoy listening! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 32:28 SplunkTalk - #25 - The Fishbucket List http://blogs.splunk.com/2010/12/06/splunktalk-25-the-fishbucket-list/ The Silver Anniversary of SplunkTalk is upon us... This week's episode is all about "the fishbucket". Whats that? Listen and you'll see--(Hint, its the way Splunk keeps track of what files it has eaten). Keepin it nerdy this time--Jeff, Michael and Maverick are all back together in to one action-packed audio file.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 06 Dec 2010 17:51:38 -0600 Tips &amp; Tricks http://blogs.splunk.com/p?=2647 Splunk The Silver Anniversary of SplunkTalk is upon us... This week's episode is all about "the fishbucket". Whats that? Listen and you'll see--(Hint, its the way Splunk keeps track of what files it has eaten). Keepin it nerdy this time--Jeff, Michael and Maverick are all back together in to one action-packed audio file. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 33:15 SplunkTalk - #24 - A hazy shade of Black Friday Apparently Jeff Blake & the Splunk Ninja just couldn't take time off, they had to crank out an episode of SplunkTalk. On this week's episode while Maverick's digitally captured laugh appears, Jeff and Michael chat about SAP Audit Logs and how to deal with line breaking issues and strategies around test deployments as you're preparing to go live. Short & Sweet.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 29 Nov 2010 10:48:26 -0600 splunktalk-24-ahazy-shade-of-black-friday Splunk Apparently Jeff Blake & the Splunk Ninja just couldn't take time off, they had to crank out an episode of SplunkTalk. On this week's episode while Maverick's digitally captured laugh appears, Jeff and Michael chat about SAP Audit Logs and how to deal with line breaking issues and strategies around test deployments as you're preparing to go live. Short & Sweet. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 17:26 SplunkTalk - #23 - Correlation, Compliance & Cranberries http://blogs.splunk.com/2010/11/22/splunktalk-23-correlation-compliance-cranberries/ Another lonely week without our co-host Jeff Blake--reportedly taming wolverines in Michigan's Upper Peninsula, Maverick and the Splunk Ninja have discussions on topics ranging from how to do event correlation with Splunk, some neat compliance use-case features, and even what we're thankful for in 2010, as Thanksgiving holiday approaches quickly. Action packed as always!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Tue, 23 Nov 2010 00:29:52 -0600 Tips &amp; Tricks http://blogs.splunk.com/p?=2623 Splunk Another lonely week without our co-host Jeff Blake--reportedly taming wolverines in Michigan's Upper Peninsula, Maverick and the Splunk Ninja have discussions on topics ranging from how to do event correlation with Splunk, some neat compliance use-case features, and even what we're thankful for in 2010, as Thanksgiving holiday approaches quickly. Action packed as always! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 37:53 SplunkTalk - #22 - ...and then there were two. http://blogs.splunk.com/2010/11/15/splunktalk-22-and-then-there-were-two/ Its just the two of us, Maverick and theWilde on the show this week after a one week hiatus, SplunkTalk is back! For the 22nd episode we've got questions about resources needed for running Splunk on a VM, how to change the behavior of "OTHER" in a timechart, and a mountain of silliness--per usual.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 15 Nov 2010 02:17:41 -0600 Tips &amp; Tricks http://blogs.splunk.com/p?=2512 Splunk Its just the two of us, Maverick and theWilde on the show this week after a one week hiatus, SplunkTalk is back! For the 22nd episode we've got questions about resources needed for running Splunk on a VM, how to change the behavior of "OTHER" in a timechart, and a mountain of silliness--per usual. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 23:36 SplunkTalk - #21 - Something is sucking my disk We're back to our traditional Q&A format on this week's episode. The crazy title should give you some hint we're chatting about disk, storage, and Splunk's "database". Jeff and Maverick were at SplunkLive in Dallas this week. Splunk Ninja learned that in fact "MAX_EVENTS = -1" is the wrong approach for linemerging. Lots of goodies on the show, and as always, a few laughs along the way!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 31 Oct 2010 12:01:04 -0500 splunktalk-21-something-is-sucking-my-disk Splunk We're back to our traditional Q&A format on this week's episode. The crazy title should give you some hint we're chatting about disk, storage, and Splunk's "database". Jeff and Maverick were at SplunkLive in Dallas this week. Splunk Ninja learned that in fact "MAX_EVENTS = -1" is the wrong approach for linemerging. Lots of goodies on the show, and as always, a few laughs along the way! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 30:41 SplunkTalk - #20 - Live from Interop NYC 2010 The 20th episode of SplunkTalk is live from the Network Operations Center (NOC) at Interop NYC 2010. Super Splunker Karandeep "Deep" Bains shares his experiences being a part of the Interop NOC staff, vast knowledge of Splunk and even schools Wilde on the true origin of the "fishbucket". Questions, answers, noise and mayhem in the Interop NOC!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 25 Oct 2010 22:17:59 -0500 splunktalk-20-live-from-interop-nyc-2010 Splunk The 20th episode of SplunkTalk is live from the Network Operations Center (NOC) at Interop NYC 2010. Super Splunker Karandeep "Deep" Bains shares his experiences being a part of the Interop NOC staff, vast knowledge of Splunk and even schools Wilde on the true origin of the "fishbucket". Questions, answers, noise and mayhem in the Interop NOC! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 29:29 SplunkTalk - #19 - The Soft GUI Center http://blogs.splunk.com/2010/10/18/splunktalk-19-the-soft-gui-center/ This week's episode features the number one answer man on Answers.Splunk.com - Gerald Kanapathy. Maverick is off this week, perhaps Spelunking in New Mexico. Jeff and Michael chat with Gerald about the Splunk GUI--its nuances, and strange terms we often wonder about. The usual nerdy banter, with a few extra giggles from Documentation Writer Sophy Ting & John Mark Walker discusses the upcoming Splunk User Group in SF!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 18 Oct 2010 15:57:23 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=2290 Splunk This week's episode features the number one answer man on Answers.Splunk.com - Gerald Kanapathy. Maverick is off this week, perhaps Spelunking in New Mexico. Jeff and Michael chat with Gerald about the Splunk GUI--its nuances, and strange terms we often wonder about. The usual nerdy banter, with a few extra giggles from Documentation Writer Sophy Ting & John Mark Walker discusses the upcoming Splunk User Group in SF! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 28:42 SplunkTalk - #18 - The big event http://blogs.splunk.com/2010/10/10/splunktalk-18-the-big-event/ What a blast! The Splunk Ninja and Maverick were "live" at Splunk HQ with Jeff remote in Chicago. Today's chat is all about eventtypes and their use for classifying events and making search more useful for certain users. Also, we cover the many ways to calculate duration between ranges of events. John Mark Walker, Splunk's Director of Community covers some upcoming meetups. "This is by far one of the funniest episodes we've done" says Michael Wilde, Splunk Ninja, and producer/editor of this podcast. Enjoy this one.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 11 Oct 2010 00:08:28 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=2255 Splunk What a blast! The Splunk Ninja and Maverick were "live" at Splunk HQ with Jeff remote in Chicago. Today's chat is all about eventtypes and their use for classifying events and making search more useful for certain users. Also, we cover the many ways to calculate duration between ranges of events. John Mark Walker, Splunk's Director of Community covers some upcoming meetups. "This is by far one of the funniest episodes we've done" says Michael Wilde, Splunk Ninja, and producer/editor of this podcast. Enjoy this one. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 32:27 SplunkTalk - #17 - I've got my Splunk pipe Today on SplunkTalk its all about search and all about pipes! We deviate from our normal Q&A format to have a spirited discussion around the search language, the "pipe" character, how to string search commands together and make awesome unicorn-laden double rainbows happen. Jeff, Michael and Maverick are at it again. Enjoy.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 04 Oct 2010 20:03:07 -0500 splunktalk-17-ive-got-my-splunk-pipe Splunk Today on SplunkTalk its all about search and all about pipes! We deviate from our normal Q&A format to have a spirited discussion around the search language, the "pipe" character, how to string search commands together and make awesome unicorn-laden double rainbows happen. Jeff, Michael and Maverick are at it again. Enjoy. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 27:12 SplunkTalk - #16 - The long hard road http://blogs.splunk.com/2010/09/26/splunktalk-16-the-long-hard-road/ The 16th episode of SplunkTalk is all about custom log files and data sources. How to properly index them, considerations around reporting and field extraction and even screen-scraped output from mainframes is all the rage for Michael, Jeff & Maverick. Jeff's got a Splunk User Group coming up this week in Columbus, Ohio, Maverick's battery went dead...and Wilde.. we'll he's just Wilde.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 26 Sep 2010 11:17:06 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=2215 Splunk The 16th episode of SplunkTalk is all about custom log files and data sources. How to properly index them, considerations around reporting and field extraction and even screen-scraped output from mainframes is all the rage for Michael, Jeff & Maverick. Jeff's got a Splunk User Group coming up this week in Columbus, Ohio, Maverick's battery went dead...and Wilde.. we'll he's just Wilde. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 23:08 SplunkTalk - #15 - The calm before the storm This week, Jeff Blake, Field Reporter and Weatherman is on location inside the eye of something called "Hurricane Sean". Topics for this episode are: Putting a Pause/Play button on a real-time dashboard and monitoring Windows WMI from Linux. We chat a bit about Splunk Answers and a new Splunk app on SplunkBase developed by Nick Mealy and David Carasso called "Splunk Discover" -- analyzes your Splunk install and examines the data for fields and reports. Check it out!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 19 Sep 2010 12:26:13 -0500 splunktalk-15-the-calm-before-the-storm Splunk This week, Jeff Blake, Field Reporter and Weatherman is on location inside the eye of something called "Hurricane Sean". Topics for this episode are: Putting a Pause/Play button on a real-time dashboard and monitoring Windows WMI from Linux. We chat a bit about Splunk Answers and a new Splunk app on SplunkBase developed by Nick Mealy and David Carasso called "Splunk Discover" -- analyzes your Splunk install and examines the data for fields and reports. Check it out! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 25:20 SplunkTalk - #14 - Dashboard Madness On this weeks episode of our weekly Splunk Q&A we discuss issues around dashboards. Some are slow, some are ugly, we'll talk about how to make them better, faster, stronger!. "Real Jeff" is back this week. He's got some advice for users having difficulty with the moving parts of a Splunk app and chats about a few gotcha's with packaging apps for SplunkBase. Maverick stars on the HackIsWack.com website, SplunkNinja has published analytics openly for this podcast and lots more!

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 12 Sep 2010 21:21:30 -0500 splunktalk-14-dashboard-madness Splunk On this weeks episode of our weekly Splunk Q&A we discuss issues around dashboards. Some are slow, some are ugly, we'll talk about how to make them better, faster, stronger!. "Real Jeff" is back this week. He's got some advice for users having difficulty with the moving parts of a Splunk app and chats about a few gotcha's with packaging apps for SplunkBase. Maverick stars on the HackIsWack.com website, SplunkNinja has published analytics openly for this podcast and lots more! Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 25:39 SplunkTalk - #13 - The Secret of NIM-ish http://blogs.splunk.com/2010/09/04/splunktalk-13-the-secret-of-nim-ish/ This week, we have a "New Jeff" on the show. Splunker Nimish Doshi makes a celebrity appearance on SplunkTalk. We chat about some of the ways Splunk itself uses Splunk in our support group, questions on searching & reporting on relative time ranges, options and advice on scripted alert actions and so much more! News, views, and Nimish attempts to fill the gaping void left by Jeff Blake's mysterious absence. Enjoy this week's episode.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 05 Sep 2010 00:22:16 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=2150 Splunk This week, we have a "New Jeff" on the show. Splunker Nimish Doshi makes a celebrity appearance on SplunkTalk. We chat about some of the ways Splunk itself uses Splunk in our support group, questions on searching & reporting on relative time ranges, options and advice on scripted alert actions and so much more! News, views, and Nimish attempts to fill the gaping void left by Jeff Blake's mysterious absence. Enjoy this week's episode. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 24:41 SplunkTalk - #12 - Double rainbow all the way across the podcast http://blogs.splunk.com/2010/08/30/splunktalk-12-double-rainbow-all-the-way-across-the-podcast/ Episode 12 brings us unparalleled agreement between Maverick and Jeff--a first in SplunkTalk history. On today's show we answer questions about search performance, how to find "light speed" of your Splunk server, some thrilling questions on baselining and statistics, and oh so much more!. News, views, even some metrics on the Podcast. Enjoy this week's episode.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Mon, 30 Aug 2010 17:39:27 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=2128 Splunk Episode 12 brings us unparalleled agreement between Maverick and Jeff--a first in SplunkTalk history. On today's show we answer questions about search performance, how to find "light speed" of your Splunk server, some thrilling questions on baselining and statistics, and oh so much more!. News, views, even some metrics on the Podcast. Enjoy this week's episode. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 23:22 SplunkTalk - #11 - The boys are back in town! http://blogs.splunk.com/2010/08/22/splunktalk-11-the-boys-are-back-in-town/ Back from our road trip to San Francisco, CA for Splunk's First (and very successful) Worldwide User Conference, SplunkTalk continues. On today's show, we cover questions about "baking Splunk in to gold images", sending SNMP traps as alerts, and improving on Splunk's multiline event handling. News, views, and Jeff's bone dry sense of humor, enjoy this week's episode.

Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air!

]]> Sun, 22 Aug 2010 11:28:35 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=2116 Splunk Back from our road trip to San Francisco, CA for Splunk's First (and very successful) Worldwide User Conference, SplunkTalk continues. On today's show, we cover questions about "baking Splunk in to gold images", sending SNMP traps as alerts, and improving on Splunk's multiline event handling. News, views, and Jeff's bone dry sense of humor, enjoy this week's episode. Episodes are recorded live every Friday at 11AM Central Time - Email us at splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 20:31 SplunkTalk - #10 - The Perfect Decimal - Live from Splunk User.Conf 2010 Tue, 17 Aug 2010 00:23:01 -0500 splunktalk-10-the-perfect-decimal-live-from Splunk This week, we're live at Splunk User Conference 2010. An excellent event that featured sessions, keynotes, education, and general Splunkery. Interviews with Ledio Ago & Lamar Holtzclaw of Splunk, Matt Uebel of Netsmart, and David Hazekamp, primary developer for Splunk ESS with Glasshouse Technologies. Recorded live, with noise, and Jeff's laugh. SplunkTalk 10 at User.Conf 10. What a perfect decimal. splunk clean 32:40 SplunkTalk - #9 - Gettin' Ready for UserConf 2010 http://blogs.splunk.com/2010/08/08/splunktalk-9-gettin-ready-for-userconf-2010/ Sun, 08 Aug 2010 11:11:30 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1947 Splunk This episode features a preview and commentary on some of the sessions and workshops occuring at Splunk's first Worldwide User Conference - August 9-11, 2010 in San Francisco, CA. We'll be there, we hope you will as well. - Questions, Answers, News and Views. --- Episodes are recorded live every Friday at 11AM Central Time - Email splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 18:51 SplunkTalk - #8 - Too much time on my hands http://blogs.splunk.com/2010/08/01/splunktalk-8-too-much-time-on-my-hands/ Mon, 02 Aug 2010 00:09:34 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1931 Splunk Its all about timestamping on episode 8 of SplunkTalk. We'll be covering how Splunk figures out and extracts time from your events so it can organize them properly, some cool ways to configure it and other strange nuances that creep up with multiple different time formats. Nerd meter is at 11!! - Questions, Answers, News and Views. --- Episodes are recorded live every Friday at 11AM Central Time - Email splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 20:34 SplunkTalk - #7 - Gleaming the DataCube http://blogs.splunk.com/2010/07/18/splunktalk-7-gleaming-the-datacube/ Sun, 18 Jul 2010 23:45:57 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1883 Splunk We're "all over the place" this week! We'll be chatting about how to make reporting a whole lot faster than you think it can be, helping you understand why the *NIX App doesn't work on HP-UX quite yet, and Whats the deal with Apache--why doesn't it syslog the http access log. Oy Vey! Questions, Answers, News and Views. --- Episodes are recorded live every Friday at 11AM Central Time - Email splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 17:34 SplunkTalk - #6 - Captain Obvious vs. Captain Bouffant http://blogs.splunk.com/2010/07/12/splunktalk-6-captain-obvious-vs-captain-bouffant/ Mon, 12 Jul 2010 15:14:08 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1876 Splunk This week we chat most of the questions are centered around failure when monitoring files and issues with forwarders. Actual addresses where the hosts live are given out on air, if you can believe it! Questions, Answers, News and Views. --- Episodes are recorded live every Friday at 11AM Central Time - Email splunktalk@splunk.com to ask questions and have them answered on air! splunk clean 19:23 SplunkTalk - #5 - Freedom from Noise http://blogs.splunk.com/2010/07/03/splunktalk-5-freedom-from-noise/ Sat, 03 Jul 2010 22:45:23 -0500 podcast Tips &amp; Tricks http://blogs.splunk.com/p?=1848 Splunk This week its all about black & whitelists, filtering and forwarding to third party systems. Your questions answered with humor, mindless banter and lots of fun! splunk, technology clean 18:10 SplunkTalk - #4 - Things that make you go... WTF?!? http://blogs.splunk.com/2010/06/26/splunktalk-4-things-that-make-you-go-wtf/ Sun, 27 Jun 2010 00:11:38 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1856 Splunk In this week's episode, we are focusing on issues that cause you to pull your hair out. Misconfigured hostnames in syslog events, indexing archived logfiles, and no GUI on your lightweight forwarder?!? News & Views, talk and lots of silliness... all about Splunk. splunk clean 48:11 SplunkTalk - #3 - Kitties on Doorsteps http://blogs.splunk.com/2010/06/17/splunktalk-3-kitties-on-doorsteps/ Fri, 18 Jun 2010 02:50:42 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1857 Splunk In this week's episode, we cover questions on how to address event tampering with hashing, file system change monitoring, and shortening long search strings.. and a preview of "The Hour of Nimish". News & Views, talk and fun... all about Splunk. splunk clean 42:50 SplunkTalk - #2 - No Pollution only Search Distribution http://blogs.splunk.com/2010/06/11/splunktalk-2-no-pollution-only-search-distribution/ Fri, 11 Jun 2010 23:40:41 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1858 Splunk In this weeks episode, your faithful Splunkers have a chat about Distributed Search in Splunk. Questions, Answers, News and Views. --- Episodes are recorded live every Friday at 11AM Central Time - Email splunktalk@splunk.com to ask questions and have them answered on air! no 26:42 SplunkTalk - #1 - It has begun! http://blogs.splunk.com/2010/06/03/splunktalk-1-it-has-begun/ Fri, 04 Jun 2010 02:50:42 -0500 Tips &amp; Tricks http://blogs.splunk.com/p?=1859 Splunk In this weeks episode, we cover questions on using multiple indexes on your Splunk server, IIS sourcetyping best practices and Forwarding, (Snare, WMI, or Splunk--what's best?). no 27:30