Hi all. We are running an environment with a SHC. After upgrading to v6.6.1, the SH started showing the following message: "KV Store changed status to failed. Failed to establish communication with KVStore. See splunkd.log for details." Any ideas what may be the problem? regards, GMA ... View more

Hello splunkers. We have about 50 clients registered at our Forwarder Management. However, since a couple days ago, only 18 of them are listed in the Forwarder Management. The command $SPLUNK_HOME/bin/splunk list deploy-clients return the same 18 clients. However, I can see data from the other 32 forwarders beeing indexed at Splunk. As a test, I ran the following command $SPLUNK_HOME/bin/splunk set deploy-poll IP:8089 -auth user:passwd in one of the clients that is not listed in Forwarder Management, received the the Configuration updated message and restarted it. However, the client is still not listed on Forwarder Management, and I need to push new apps to it. Any ideas? Regards, GMA ... View more

Hello Splunkers. I'm indexing some SNMP data from a server. Here is one event indexed: HOST-RESOURCES-MIB::hrStorageDescr."31" = "/" HOST-RESOURCES-MIB::hrStorageDescr."35" = "/tmp" HOST-RESOURCES-MIB::hrStorageDescr."36" = "/home" HOST-RESOURCES-MIB::hrStorageDescr."37" = "/usr" HOST-RESOURCES-MIB::hrStorageDescr."38" = "/usr/local" HOST-RESOURCES-MIB::hrStorageDescr."39" = "/var" HOST-RESOURCES-MIB::hrStorageDescr."40" = "/var/log" HOST-RESOURCES-MIB::hrStorageDescr."41" = "/opt" HOST-RESOURCES-MIB::hrStorageDescr."42" = "/opt/nds/data" HOST-RESOURCES-MIB::hrStorageDescr."43" = "/var/log/nds" HOST-RESOURCES-MIB::hrStorageDescr."44" = "/var/log/splunk" HOST-RESOURCES-MIB::hrStorageDescr."45" = "/boot" HOST-RESOURCES-MIB::hrStorageSize."1" = "132061388" HOST-RESOURCES-MIB::hrStorageSize."3" = "168263816" HOST-RESOURCES-MIB::hrStorageSize."6" = "132061388" HOST-RESOURCES-MIB::hrStorageSize."7" = "94129872" HOST-RESOURCES-MIB::hrStorageSize."10" = "36202428" HOST-RESOURCES-MIB::hrStorageSize."31" = "1015393" HOST-RESOURCES-MIB::hrStorageSize."35" = "1015385" HOST-RESOURCES-MIB::hrStorageSize."36" = "1523090" HOST-RESOURCES-MIB::hrStorageSize."37" = "2030792" HOST-RESOURCES-MIB::hrStorageSize."38" = "1015385" HOST-RESOURCES-MIB::hrStorageSize."39" = "2030792" HOST-RESOURCES-MIB::hrStorageSize."40" = "2538497" HOST-RESOURCES-MIB::hrStorageSize."41" = "12696559" HOST-RESOURCES-MIB::hrStorageSize."42" = "5073149" HOST-RESOURCES-MIB::hrStorageSize."43" = "19045441" HOST-RESOURCES-MIB::hrStorageSize."44" = "7384608" HOST-RESOURCES-MIB::hrStorageSize."45" = "507684" HOST-RESOURCES-MIB::hrStorageUsed."1" = "102838612" HOST-RESOURCES-MIB::hrStorageUsed."3" = "102838612" HOST-RESOURCES-MIB::hrStorageUsed."6" = "4708464" HOST-RESOURCES-MIB::hrStorageUsed."7" = "94129872" HOST-RESOURCES-MIB::hrStorageUsed."10" = "0" HOST-RESOURCES-MIB::hrStorageUsed."31" = "188130" HOST-RESOURCES-MIB::hrStorageUsed."35" = "55800" HOST-RESOURCES-MIB::hrStorageUsed."36" = "1302834" HOST-RESOURCES-MIB::hrStorageUsed."37" = "868359" HOST-RESOURCES-MIB::hrStorageUsed."38" = "165013" HOST-RESOURCES-MIB::hrStorageUsed."39" = "1473096" HOST-RESOURCES-MIB::hrStorageUsed."40" = "1659690" HOST-RESOURCES-MIB::hrStorageUsed."41" = "9159791" HOST-RESOURCES-MIB::hrStorageUsed."42" = "779795" HOST-RESOURCES-MIB::hrStorageUsed."43" = "8276891" HOST-RESOURCES-MIB::hrStorageUsed."44" = "86509" HOST-RESOURCES-MIB::hrStorageUsed."45" = "13485" What I want to do is something like the table below: Partition Avail. Used Used% / 1015393 188130 18,52 /tmp 1015385 55800 5,49 /home 1523090 1302834 85,53 /usr 2030792 868359 42,75 /usr/local 1015385 165013 16,25 /var 2030792 1473096 72,53 /var/log 2538497 1659690 65,38 /opt 12696559 9159791 72,14 /opt/ser/data 5073149 779795 15,37 /var/log/ser 19045441 8276891 43,45 /var/log/splunk 7384608 86509 1,17 /boot 507684 13485 2,65 I'd like to use the "id" in each line to correlate to the same "id" in other line. How can I do this? Thanks in advance! ... View more

Hello Splunkers. Using the wineventlog I can tell when a user logged on and off based on EventCodes 4624 and 4634 and the logon id: Logon: 03/09/2017 11:54:51 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4624 EventType=0 Type=Information ComputerName=xxxxxxxxxx TaskCategory=Logon OpCode=Info RecordNumber=xxxxx Keywords=Audit Success Message=An account was successfully logged on. ... New Logon: Security ID: XXX\visit Account Name: visit Account Domain: XXX Logon ID: 0xA2207D111 Logoff 03/09/2017 12:11:21 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4634 EventType=0 Type=Information ComputerName=xxxxxx TaskCategory=Logoff OpCode=Info RecordNumber=xxxxxx Keywords=Audit Success Message=An account was logged off. Subject: Security ID: XXX\visit Account Name: visit Account Domain: XXX Logon ID: 0xA2207D111 However, I need to know when exists the same Account Name using two machines, I mean, when there are two sessions active at the same time. Any ideas how can I do this? Regards, GMA ... View more

Hello Splunkers. I'm starting to work with KV store. I used this exemple to practice: http://dev.splunk.com/view/SP-CAAAEZC It's very interesting and is something I can use in my company with a little changes. By the steps, we can ADD a row and DELETE a row. How about updating a row? I mean, I have the _key info, so I think that an update should be possible. For example, a customer changed his address and I want to update his address field. Can you guys help me? Regards, GMA ... View more

Hello Splunkers. I've upgraded my Search Head Cluster (SHC) [6 members, 1 deploy] from version 6.3.1 to version 6.5.1 . The upgrade of the deploy was OK. However, after upgrading all the SHC members, we were not able to see to following: - Job inspector: when clicking on the Job Inspector link of a search, I receive the error 404. - View recent: when clicking on "View recent" on a saved search, I receive the error 404. - SPL highlight: this is not working, the commands and arguments don't change color as they should. It looks like Splunk Web did not change to 6.5.1. The searches and dashboards are fine, I can search and report correctly. On the deploy, I have the following results to the splunk validate files command: /splunk_bin/splunk/bin/splunk validate files Validating installed files against hashes from '/splunk_bin/splunk/splunk-6.5.1-f74036626f0c-linux-2.6-x86_64-manifest' All installed files intact. On any member of the SHC, I get the following message: /splunk_bin/splunk/bin/splunk validate files Validating installed files against hashes from '/splunk_bin/splunk/splunk-6.5.1-f74036626f0c-linux-2.6-x86_64-manifest' File '/splunk_bin/splunk/etc/apps/introspection_generator_addon/default/README' changed. File '/splunk_bin/splunk/etc/apps/introspection_generator_addon/default/app.conf' changed. File '/splunk_bin/splunk/etc/apps/sample_app/metadata/default.meta' changed. File '/splunk_bin/splunk/etc/apps/search/bin/crawl_network.py' changed. File '/splunk_bin/splunk/etc/apps/search/bin/erex.py' changed. File '/splunk_bin/splunk/etc/apps/search/bin/predict.py' changed. File '/splunk_bin/splunk/etc/apps/search/bin/runshellscript.py' changed. File '/splunk_bin/splunk/etc/apps/search/default/data/ui/manager/admin_directory.prod_lite.xml' changed. Could not open '/splunk_bin/splunk/etc/apps/search/default/data/ui/manager/admin_macros.prod_lite.xml': No such file or directory File '/splunk_bin/splunk/etc/apps/search/default/data/ui/manager/admin_win-admon.xml' changed. File '/splunk_bin/splunk/etc/apps/search/default/data/ui/manager/admin_win-event-log-collections.xml' changed. ... Could not open '/splunk_bin/splunk/etc/apps/search/default/transforms.conf': No such file or directory File '/splunk_bin/splunk/etc/apps/search/metadata/default.meta' changed. File '/splunk_bin/splunk/etc/apps/user-prefs/default/app.conf' changed. File '/splunk_bin/splunk/etc/apps/user-prefs/default/user-prefs.conf' changed. File '/splunk_bin/splunk/etc/apps/user-prefs/metadata/default.meta' changed. I get that some files were changed and some files do not exists. I've tried to reinstall the version 6.5.1 and even tried to copy the files from deploy to SHC members. However, when starting Splunk, looks like it erases this files. Have you guys ever saw this? Any hints? Regards, Guilherme ... View more

Hello Splunkers. How can I integrate IdM (Identity Manager) with Splunk? For LDAP data, I'm using the Splunk Support for Active Directory add-on so I can run a ldapsearch command. But I'm kind of lost on how to integrate IdM (IdM by Novell). Any ideas? Thank you all! Regards ... View more