The reason that your getting this error message warning of "This pool contains slave(s) with 1 warnings" is because you are using the same license on two servers. Splunk is aware that your trial license is in use on two indexing servers. Disabling the installation that is a duplicate and that will fix your problem. I'm not sure which release your on but you can check which is the slave and master by going under Manager » Licensing. ... View more

rroberts - You can make the change under $SPLUNK_HOME/etc/apps/pdfserver/bin/pdfhandler.py. ... View more

The pdf_server.conf defines a setting for client_ipaddr - It's not set by default, which means any Splunk instance, from any IP address can access the PDF server. If set, it should be set to the the IP address (or range of addresses) that the PDF server may be accessed from. Eg. If you've got a Windows search head on 10.0.0.1 and the PDF app is running on a Splunk instance on 10.0.0.2 then you'd set client_ip to 10.0.0.1 In this case it must be set to an address or range that does not match the address of the server the request is coming from. ... View more

The error message version `GLIBC_2.4' indicates a version issue. You can use the command ls -l /lib64/tls/libc.so.6 to verify that you have the correct lib version. On 64 bit systems glibc 2.4 is required for 64 bit systems, eg. Centos 5.0 or later) ... View more

Recommendation: Run the "splunk diag" utility, open a case and upload the diag file to your case, Splunk Support will provide you assistance. Here are a few things to check, according to the url listed below: Check disk space on all of your partitions. If your space is too low, then that will cause indexing and searching problems. Verify that "splunk-optimize" has been running. If you see a large number of *.tsidx files in your buckets, you can simply run splunk-optimize /path/to/your/bucket to force this process to run. Try disabling some non-essential scheduled saved searches and see if that helps relieve the problem. (You probably don't want to do this for summary-indexing saved searches, if it can be avoided.) http://splunk-base.splunk.com/answers/7996/down-error-skipped-indexing-of-internal-audit-event-will-keep-dropping-events-until-indexer-congestion-is-remedied-check-disk-space-and-other-issues-that-may-cause-indexer-to-block ... View more

PDF Server Status: Configuration PDF server is installed: True PDF server is enabled: True SMTP server set: True reportPaperSize letter reportServerEnabled 1 reportPaperOrientation portrait reportServerURL Test PDF generation NOTE: Firefox users will see a PDF open in a separate window. IE, Safari, and Chrome users will see the PDF directly inside the blue box It will take approx 5-20 seconds for the PDF to show up. If this box is blank or no download occurs after 60 seconds, the PDF server may not be functioning correctly. Call support for assistance. ... View more

The cursorTime at 2038 is an artifact of not having eliminated any buckets yet. ... View more

Starting in 4.1.4, remote CLI access is disabled by default for the admin user until you have changed its default password. To enable the remote access you will have to set the following stanza: $SPLUNK_HOME/etc/system/local/server.conf and set the value: allowRemoteLogin=always ... View more