 |
DESCRIPTION
Splunk Server indexes logs from ANY source (apache, OS X, sendmail, routers). No need to configure it for specific formats, write regular expressions or change your logging output.
Search mountains of data by time, keywords, type of event, source, host or relationships to other events. Note: Splunk is server software. You configure and use the software via a web browser.
WHAT'S NEW
Version 4.0.5:
- Splunk Free is now available.
- Splunk is now officially supported on OS X 10.6 "snow leopard". (SPL-25434)
- Event signing and auditing now work as documented. (SPL-26299)
- Scripted authentication now works as documented. (SPL-26489)
- Splunk SSL now supports the use of intermediate CA certificates. (SPL-14463)
- When creating new users, all available roles are now shown in the field picker. (SPL-26185)
- Failing to define a source type in inputs.conf no longer results in an "unknown#" unsearchable source type. (SPL-26213)
- Performance has been improved when searching across separate filesystems for warm and cold storage. (SPL-26263)
- Splunk no longer truncates multi-line events of more than 500 lines. (SPL-26880)
- The .spec file for inputs.conf no longer states an inaccurate default value for rcvbuf. (SPL-24860)
- Local file upload now supports file sizes up to 500MB. (SPL-24292)
- The followTail setting in inputs.conf is now respected. (SPL-26010)
- You may now add up to 50 rows or columns in a view's layoutPanel. (SPL-26177)
- Saved searches now function correctly if user is logged in with username in different case than was used to log in when the saved search was created (for example fflanda vs. Fflanda). Refer to Migrating user configurations to 4.0.5 in the Release Notes for more information. (SPL-26335)
- Xpath command now functions correctly. (SPL-26985)
- Scrolling in panel layout view now works correctly in IE7. (SPL-24861)
- Distributed search on Solaris now returns all results. (SPL-27006,SPL-26440)
- A crash involving the TcpInputProcessor thread on distributed search heads has been resolved. (SPL-26568)
- Show source on Firefox 3.5 now shows the source of the correct event. (SPL-25578)
- Logs forwarded from the lightweight forwarder are now timestamped correctly. (SPL-26949)
- Whitelisted symlinks pointing to non-whitelisted files now result in the target files being indexed. (SPL-26718)
- The custom time range picker in Splunk Web no longer closes too quickly to use in small browser windows. (SPL-26674)
- The vmstat.sh script from the *Nix app no longer fails. (SPL-26635)
- When defining a scripted input in Splunk Web, it is no longer possible to erroneously select 'automatic' as a source type. (SPL-26608)
- The permission setting on $SPLUNK_HOME/etc/apps/*/metadata now allows updates to permissions on views even if you're not running as root. (SPL-26603)
- It's no longer possible to save an unnamed event type in Splunk Manager. (SPL-26536)
- There is a new forwarder backoff settings section in outputs.conf to configure the slowdown of subsequent attempted connections to an indexer when there are repeated failed connections. (SPL-26478)
- An issue with high memory usage resulting in a INDEXER_INTERNAL_MEMORY_ERROR error has been resolved. (SPL-26466)
- Running the delete operator now correctly deletes metadata. (SPL-26415)
- The makemv and mvexpand search commands now function correctly. (SPL-26304)
- When enabling audit event signing, the ID field for the sequential number is now labeled search_id instead of just "id", which was already in use. (SPL-26283)
- Setting the input type for compressed files explicitly now works correctly. (SPL-25812)
- Deleting large numbers of events from the CLI works correctly. (SPL-25751)
- Splunk Web now consistently displays the selected timezone. (SPL-25728)
- The "business_week_to_date" timerange option now functions correctly. (SPL-25629)
- Users with spaces in their usernames can now edit views. (SPL-25537)
- An issue with non-UTF-8 characters in usernames has been resolved. (SPL-25503)
- Setting updateCheckerBaseURL= 0 no longer prevents Splunk Web from loading. (SPL-25319)
- Event auditing data now forwards correctly. (SPL-24485)
- The 'frozenTimePeriodInSecs' and 'maxTotalDataSizeMB' settings in indexes.conf are now properly respected. (SPL-23415)
- Issues with search stemming have been resolved (when you search explicitly for 10.3.2.1 you will not get results for 10.3.2.100). (SPL-17103)
- The testmode option for the collect data type now works correctly. (SPL-15853)
- Spaces are now supported in stanza names in auth.conf. (SPL-5609)
- Invalid .tmp directories (such as artifacts of partially decompressed directories) are now ignored. (SPL-27101)
- Saved searches now support terms in quotes. (SPL-26763)
REQUIREMENTS
Mac OS X 10.5 or later.
| SCREENSHOT
OTHER PEOPLE SUGGEST No similar products suggested yetSuggest something else: |
|
 |
|  |
 | |  |
| Splunk User Reviews (2 posts) | Write A Review |
 | Apr 27 2009 |
MACMEND I just installed this, and then realised there is no directions on how to uninstall, the installer is very comprehensive, uninstall is not. Python based by the look of it and really for the geek user. I have spent a long time demythologising IT, I hate geek style stuff, packed with geek speak and terminal stuff when a simple gui would do. If only spiceworks worked on mac
(Version 3.4.8) | |
| [ Reply ] | |
 | Nov 16 2007 |
ALRESCHA The system requirements on their web page indicate that this web-based engine does not work with Safari. Up till then, it looked pretty interesting.
(Version 3.1.2) | |
| [ 19 Replies - Reply ] | |
Replies:
| Nov 29 2007 |
SJK Yeah, lack of Safari support killed my interest in Splunk.
(Version 3.1.3) | |
| May 23 2008 |
MAC OS X 4EVER I can't believe so many users are oblivious to FireFox. Safari sucks. There are no plugins for it and you have no control over it. FireFox can do just about anything. It's a plus that it doesn't work with Safari! Maybe it will help new users that don't know any better to discover FireFox.
(Version 3.2.4) | |
| May 23 2008 |
SJK What a daft comment. Some of us consciously prefer Safari to Firefox; read http://daringfireball.net/2008/04/firefox_3_safari_3 for some reasons why.
(Version 3.2.4) | |
| Jun 17 2008 |
You know you can use both...right? | |
| Jul 1 2008 |
MONDELE I happen to be someone who typically has a dozen browsers on my machine, but I do agree that to require a non-Safari browser for a piece of software will limit its acceptability. Web standards are there for a reason, and to make a web-based interface that won't work with a standards-compliant browser is, IMHO, shortsighted.
(Version 3.3) | |
| Jul 31 2008 |
ZANGIEF Ugh, Firefox is waaaay slow, even Mac-optimised builds like Minefield. No Safari support means less users.
(Version 3.3.1) | |
| Jul 31 2008 |
MIKAELF Firefox is 3.0.1 is not slow and is the more compliant browser on the web and it exists on all platforms. Obvious target for any smart web developer. Splunk's mac customers is probably less than %1. Look at what they do and there reference customers. How many of those do you think run Mac OS X server...I would say very very few.... | |
| Jul 31 2008 |
ZANGIEF Safari's fine by me and, after previous experiences with FF, I don't have any plans to switch.
(Version 3.3.1) | |
| Jul 31 2008 |
ZANGIEF And might I add that web development is a hobby of mine.
(Version 3.3.1) | |
| Jul 31 2008 |
MIKAELF and IT is my profession since -90.... | |
| Jul 31 2008 |
ZANGIEF Safari didn't even exist then.
(Version 3.3.1) | |
| Jul 31 2008 |
MIKAELF Seriously...it didn't? I thought the internet was there...like..always. The browser and the web apps is nothing but the "emperors new clothes" for an old block mode terminal. Only in the last couple years have AJAX technology spiced it up a bit but the principles are still the same. Text strings back and forth over a stateless transport protocol (http). | |
| Jul 31 2008 |
ZANGIEF Firefox doesn't support CSS3 from what their official website says. Safari does.
(Version 3.3.1) | |
| Jul 31 2008 |
MIKAELF Now you're being silly. There are far more websites that recognizes Firefox than there are Safari compliant ones. I never said I didn't like Safari, it is my default browser on my Mac. Firefox is the default on my Windows and Linux environments. I'm just more pragmatic...if Safari doesn't work on a website I'm visiting and I'm on my mac...I start Firefox. Big deal. Now, go get yourself a job.... | |
| Jul 31 2008 |
ZANGIEF I'm 13. How am I supposed to do that?
(Version 3.3.1) | |
| Jul 31 2008 |
I think what you are missing is that if Splunk were written in a standards-compliant way, it would work with Safari. I don't know of any deficiencies of Safari that would keep it from working with the kind of behavior we are looking for from Splunk. As I mentioned, I tend to use a lot of different browsers, and I use the one that I think will work best for a particular purpose. I do tend to use FireFox for web development because of the plugins that expand capabilities in that regard, but Safari is a fine browser, and many people will feel that it is the only one they need. If Splunk will not run with Safari, it is a valid comment to say that it is therefore a non-starter. Splunk may run fine on Linux and Windows, and on the Mac with FireFox, but this is MacUpdate, and the Mac users here have a legitimate concern if it doesn't function with the default Mac browser - the one with which, presumably, they are downloading Splunk. Telling people that they are silly for their software choices is a uniquely unhelpful means of persuasion.
(Version 3.3.1) | |
| Jul 31 2008 |
SJK Well said, mondele.
(Version 3.3.1) | |
| Jul 31 2008 |
I didn't say anyone was silly because of what software they were using. Then I would be silly too since Safari is my default browser...did you READ my comment? I thought the line of arguments was silly... Why Splunk doesn't work with Safari is probably because it's heavy usage of AJAX technology and frankly, there aren't enough demand. It's simple, no development org have unlimited resources so you prioritize and if there isn't a business case...why waste resources? If/when enough of Splunks customers complain and they lose deals...there will be Safari support, I'm sure. | |
| Feb 21 2009 |
VRH I use Splunk with Safari all the time and it works fine. They just don't support it "officially," but it works. There are a couple display related annoyances under Safari, but nothing intolerable. Those annoyances are not present when using Firefox.
(Version 3.4.6) | |
|
| |
|
