I have a few universal forwarders which tail a folder structure. They send the data to a indexer where also a searchhead is enabled. I need to specify in props.conf a linebreaker like so [xXx] BREAK_ONLY_BEFORE = Event[ NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = true I am confused as to where i have to specify this meaning in what place i have to add it to a props.conf. Not on the universal forwarder i gather... but where on the indexer? in $splunkhome$/etc/apps/Splunk/Forwarder ??? To contain all the configuration items for that source/usergroup i created an app and placed this snipped in the apps' /local/props.conf but it fails to separate the events by the string and insted opts for the default which is the timestamp roughly two lines below. (hint: the source is a windows eventlog export that is stripped from the xml for readibility, we feed end user workstations' eventlogs to splunk via a custom store-and-forward mechanism) ... View more

how can one pass through the credentials of the currently logged in user to a back end. example: use a connector to a directory and bind using the dn and password of the logged in user (we authenticate and authorize to the same directory but not using kerberos as it is not an AD) another example: use a connector to jira and user username and password to log into jira essentially ensuring that the user does not see more in the target system then when logged in directly. Often it makes sense to see more and hide behind reports and forms but often it would be more straightforward to pass through authentication. Is there a way to do this? Use the current users credentials? ... View more

I always get 1 ERROR 2 An unknwon error occured while performing the geoip lookup: Is there something i have to set up or pay attention to? Splunk 5.1 running on SLES11 64bit In Production environment it works whereas in the integration environment it won't resulting in this error. ... View more

After upgrading java to JRE 7 the dbx app doesn't return any search results and after a while even the searchead crashes completely. We have a integration environment and a production environment. Funny enough in the integration environment it works since i added the debug = true key to the config file whereas in the production environment there is no change. Even with the debug = true set there is not a single entry in the dbx debug log. update: there is actually something in the logs: " 2013-06-13 10:55:30.979 dbx2513:ERROR:Splunkd - Splunkd REST Service keep-alive failed! Session key probably expired. (java.io.IOException: Server returned HTTP response code: 401 for URL: https://127.0.0.1:8089/servicesNS/nobody/-/authentication/current-context/context) java.io.IOException: Server returned HTTP response code: 401 for URL: https://127.0.0.1:8089/servicesNS/nobody/-/authentication/current-context/context at sun.reflect.GeneratedConstructorAccessor21.newInstance(Unknown Source) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:525) at sun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1674) at sun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1672) at java.security.AccessController.doPrivileged(Native Method) at sun.net.www.protocol.http.HttpURLConnection.getChainedException(HttpURLConnection.java:1670) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1243) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254) at com.splunk.rest.Response.getContent(Response.java:49) at com.splunk.rest.Response.readXML(Response.java:57) at com.splunk.rest.Splunkd$KeepAlive.run(Splunkd.java:135) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471) at java.util.concurrent.FutureTask$Sync.innerRunAndReset(FutureTask.java:351) at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:178) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:178) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at java.lang.Thread.run(Thread.java:722) Caused by: java.io.IOException: Server returned HTTP response code: 401 for URL: https://127.0.0.1:8089/servicesNS/nobody/-/authentication/current-context/context at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1625) at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:468) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:338) at com.splunk.rest.Response. (Response.java:26) at com.splunk.rest.Splunkd.request(Splunkd.java:208) at com.splunk.rest.Splunkd.request(Splunkd.java:98) at com.splunk.rest.Splunkd.request(Splunkd.java:90) ... 9 more " What steps can i take to find out what is amiss? ... View more