Seeing as you don't have access to the configuration files as part of the Splunk Cloud SaaS solution - then it is 100% something Splunk should take care of. They SHOULD have alerting in place that notifies them when the error message comes up in the log entries, then resolve it - but I wouldn't be surprised if you also have to raise an incident to formally ask them to remove the user dir. ... View more

Agreed - Its the quantity of files and the directory structure which makes more of a difference. You can have 50GB of data in 10 files and it'll work fine, if you then have 50GB of data in 5000 files across 50 directories your going to see CPU going high. ... View more

I did thanks, I spoke to someone at the last Splunk Live in London and confirmed this - thanks for adding an answer though. ... View more

Did you ever find a solution to this problem? ... View more

This was my issue, I had accidentally used a full tree traversal when I thought I had told Splunk to only search for a particular file under a path. Was killing CPU on my Windows box. ... View more

This fixed for me as well. ... View more

Nope - I was told its not possible. Only way to do it would be to get the forwarder to grab the host name and send it across as part of the event. Didn't end up doing it that way though. ... View more

Solved it for me. ... View more

I tried this method, doesn't take into consideration dynamic IP addressing (DHCP Scope) - I need the dns entry to be added at the time of index and remain fixed. Anyone else found a way around this? I assume it is possible to add a field at index time from a external dns lookup but haven't found a way to implement it.... ... View more

No, im working on a new instance of Splunk running 6.3.x - just deployed 60+ forwarders and not come across this problem (although none are W2k12). Whenever I contact support about tickets they generally just tell me to 'try a more later version' - not very helpful. ... View more

Just to note, still works completely fine. Used this as a base to get rid of Logoff events. ... View more

To anyone else reading this, does not work for Windows. I moved to CentOS and works now. ... View more

Can we have an update on this please? I am encountering the same issue. ... View more

I don't have the ability to test this anymore due to a change in environment, but happy to say I didn't think of checking the access logs and pulling out the command. Based upon my research the API and the UI uses the same commands therefore I have no doubt this will work. ... View more

I also had the add on enabled, I can't prove this was the cause as I no longer have access to the environment so as good an answer as we're going to get from @tlelle! ... View more

Sounds like a bug to me then, i'd raise it with support however your unlikely to get anywhere as it'll have to go down as a P4 (Unless you have a Enterprise License sitting around - if so though you could just install that and use it). Maybe worth uninstalling Splunk Enterprise completely and downloading the latest version and re-installing - if your using the latest version already then go down a sub version i.e. if your on 6.3.x then go down to latest of 6.2.x. Then installing your Exchange App and see if you have the same behavior - I know its a bit of a pain but shouldn't take too much effort to do. I'd recommend backing up all your app config including your default 'search' app - this is so you don't lose any dashboards or other knowledge objects (you should be able to just copy them back in after the fact). ... View more

I'd go with @ctaf answer then - if you run that over the past 8 days and as an alert every day it'll trigger whenever its greater than 7 days although important to note it'll only trigger once per serial number, the next day it won't be able to alert on the serial number which hasn't appeared for 9 days. This is the main limitation of a time orientated search with dynamic checks like this in my opinion. I've used something similar to track forwarders going offline successfully, but only reports once then stops. ... View more

Add your serial numbers as a static input file, then create a search to create an outer join from the input file and your search string to return the serial numbers NOT seen in the last 7 days. If your serial number list is dynamic this will not work (you haven't mentioned it changes so assume is static). ... View more

Splunk should be running scripts as the user which splunkd runs as as far as I am aware - do you have the scripts in the $SPLUNK_HOME/bin/scripts directory? or are they part of a custom app? What sort of scripts are we talking about? Shell, VBS, Powershell? ... View more

Never found the solution, I believe it was something strange coming from a Universal Forwarder (A windows one) which fixed itself - I think it was for mis-configured index for Windows eventlog data as that happened to coincide (seems there was a bug in a older version of the UC for Windows which meant some eventlog data was forwarded despite no options being selected during installation). Fixed itself so never investigated further. ... View more

Ok ill look to get it later on, which of the below are you suggesting. Example tag: host=testing123.testdomain.com value=active Option 1: curl -k -u admin:changeme -d 'owner=foo' -d 'sharing=app' https://localhost:8089/servicesNS/admin/search/search/tags/host/acl Option 2: curl -k -u admin:changeme -d 'owner=foo' -d 'sharing=app' https://localhost:8089/servicesNS/admin/search/search/tags/host=testing123.testdomain.com/acl If option one, wouldn't this change every single tag acl for host? This wouldn't be a problem for me however some people may not want all tags updated. ... View more

Hi fronbinson Tags aren't saved searches as far as im aware (although they may be in the context of the api..) - although I have tried using the search endpoint to run them (without any success I may add). Ill take a look at your documentation at some stage and see if I can get it working! thanks for the pointer. My use case shouldn't be important to the question, however to add some context it is the following (please feel free to suggest alternatives which may work better): We are creating application containers (via docker) to create and destruct application tiers as required - the splunk integrated will also be automated. A forwarder will be sitting inside each application container and then a script will start the service and link to our search head (for deployer) and indexer. There will be multiple 'apps' which contain all the scripts and config for each application tier. As part of the initiate script a tag will be sent which says the host is 'active', then when the container is destroyed the tag for the unique hostname (the host is being overridden to ensure its unique) will be updated to 'inactive'. This will ensure any monitoring we have on that agent is disabled without any risk to the historical data. One way we could of done it was to change the hostname upon 'destruct' to contain _inactive - however any historical events would have a different hostname then. I would prefer instead to have a tag which can be dynamic and change based upon our requirements and would affect all data. ... View more