Check your inputs, by searching for index=_internal source=*splunkd.log ExecProcessor and look for warnings, errors or anything related to your scripts above. You could also go to the CLI and do a splunk show inputstatus and look for those scripts there. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 PS: Does running a smart scan on a most likely virtual storage any sense? Is SMART even available for such drives? ... View more

Did you check splunkd.log for erorrs/warnings, or infos about cert stuff? ... View more

Could you please add the complete error message? ... View more

Hey, I re-formatted your question so the error messages become more readable. You can do so yourself in the future by selecting the text in the input box and clicking the little 101010 button above. The errors you see come from the ExecProcessor, which is responsible for running scripted inputs and the like. Errors from that processor shouldn't cause the UF to go down - it's simple output from the script /opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh that arrives via the so called standard error channel ( stderr ), and usually contains errors and warnings. As this seems to be from a non-default app ( _apps_inputs ) you would have to check with the author of that app/script to see why it causes these messages. However, in this case, it's not an actual error, more of a warning/information. What do you mean by your UF being down? It's actually not running, e.g. splunk status shows it's not running? It's not visible via the Forwarder Management tab on the Deployment server? Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

It's only the AD/Exchange side. Mail (SMTP) is a pretty simple protocol (some would say stupid ;-)). So, the sending side knows literally nothing about the receiver, if it's a single user, a group, a mailbox, if it exists - it just takes the mail, contacts the mailserver for @yourdomain.tld and says "Here, deal with this mail". So - have your AD/Exchange people set up a distribution list, tell Splunk to send the mail to whatever email address your AD/Exchange people give you, and you're good. ... View more

Yeah, that's sounds rather strange... If I were you, I'd wipe the complete /opt/splunkforwarder directory and reinstall the forwarder from scratch. Be aware, however, that this might lead to duplicate events for some time. ... View more

Hey, try this for the query: index=main sourcetype=access_combined_wcookie status=200 file=success.do | fields productId | dedup productId You should make sure that you don't have spaces around your = . Also the | table part is unneccessary. Also, you use these lines: <fieldForLabel>productName</fieldForLabel> <fieldForValue>productValue</fieldForValue> but the | fields productId removes all fields but productID , so those fields are not available at all. So either - use productId with those lines, or add those two fields to the | fields command, like this: index=main sourcetype=access_combined_wcookie status=200 file=success.do | fields productId productName productValue | dedup productId Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Stupid question: Did you direct your Syslog on those devices to the IP of your Splunk instance? ... View more

From everything I found online about this, it seems to actually require local Administrator permissions... ... View more

Just a wild guess: Did you change the user Splunk is running as? ... View more

Just adding: The new behavior started with Splunk 7.1, so you'll have the old behavior with 7.0.4 and below. ... View more

The values() option only gives you each value once. If signature exists more than once, it's only contained once in the result (like an implicit dedup). Therefore, you might less results than by simply counting them. Use list() instead of values(), that should fix it. Hope that helps. ... View more

You could try this instead, but I haven't tested it: | eventstats values(username) as _recipients | eval _recipients=mvjoin(_recipients, ",") | sendemail to=$result._recipients$ The _ in front of the field name should make it invisible,but still available... Try that 🙂 ... View more

It looks as if the TA is trying to log in (using HTTP POST), but the connection is reset which usually means that there is no service running on where it wants to connect to. I'd double check any connection information you had to enter, like URL/IP/port, because this looks like an issue of the Tenable service not being available where you expected it to be. Hope that helps. ... View more

This should be an answer 😉 ... View more

Then try to use last() instead of sum(), or use max()... ... View more

Be aware that this makes Splunk send one mail per user, which might cause considerable overhead. Sending a single mail with multiple recipients might be more efficient. ... View more

Can you please share your actual complete app.conf? Did you place it in local or default? ... View more

Just to get it right - you don't get data when searching for sourcetype=a:b:c , but it works with sourcetype=a:b:c* ? ... View more