You have run into a known issue (SPL-38443) with the 4.2 Lightweight and Universal Forwarder. The Windows 4.2 lightweight and universal forwarder parses WinEventLog datastreams on the forwarder, preventing all parsing control on the indexer. The symptoms of this are: no filtering nor routing to the nullqueue based on props and transforms. WinEventLog data is bypassing props.conf and transforms.conf on the indexer. The workaround would be to use a 4.2 full/regular forwarder or 4.1.x lightweight forwarder but this will be fixed for 4.2.1 http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues ... View more

The Universal Forwarder is supported under the same system requirements as core Splunk. The following links will provide further details. http://www.splunk.com/base/Documentation/latest/Installation/Systemrequirements http://www.splunk.com/base/Documentation/latest/Deploy/Deploymentoverview The Windows Installer correctly reported the error due to a corrupted download of the msi file. While there was no download error message, the lack of disk space was a factor in the partially downloaded file. Disk space was made available and a retry of the download resulted in a successful run and installation of the Universal Forwarder. ... View more

This is a known issue. More details and options can be found here: http://answers.splunk.com/questions/12167/why-is-the-license-on-the-forwarder-search-head-displaying-a-message-it-is-expiri ... View more

If your current splunk.license key has a prefix of "forwarder@splunk.com;", you have encountered a known issue (SPL-31628) where a splunk-forwarder.license is associated with an expiration date of 2011-03-07 and your current splunk.license is a copy of this license key. The splunk.license key will have a key prefix similar to: forwarder@splunk.com;RV75...etc. This has been fixed as of 4.1.4 with an updated splunk-forwarder.license file with a new expiration date for the key. eg. 2020-06-08 In many cases,the splunk.license file on a forwarder (lightweight) or dedicated search head instance is just a copy of the splunk-forwarder.license located in $SPLUNK_HOME/etc under *Nix and on Windows at %SPLUNK_HOME%\etc The license content is not operating system specific. Similar to license volume violations, an expired license will prevent searching but indexing continues. Searching will be available once the license issue is resolved. An expired license on a forwarder will not affect its ability to continue to process data. Note: Do not confuse this with a splunk.license that has your own Enterprise license email address associated with it. If your splunk.license on your forwarder/dedicated search head instance does not start with "forwarder@splunk.com;" and there is no indication of an expiration, this issue is not applicable. In some environments while the Splunk version may have been upgraded to 4.1.4 and above, it is possible the splunk.license on the forwarder/search head instance was never manually updated with the new splunk-forwarder.license key with the new expiration date. Thus it has retained its previous Splunk version's license copy (eg. 4.0.x or pre 4.1.4) and is now displaying an expiration message. While it is beneficial to upgrade to the most current Splunk version, you do not have to upgrade your forwarder/search head instance just to fix the expired license; follow one of the steps below. Options to resolve: 1) if you have a Splunk version 4.1.4 and up already installed, simply copy the splunk-forwarder.license to be the new splunk.license on your forwarder/search head instance where the expiration message is displayed and restart Splunk or 2) use the following key to be your new splunk-forwarder.license key and splunk.license (on the LWF or dedicated search head) via either method below: a) via SplunkWeb > Manager > License > Change License and replace the existing with the key below and restart Splunk or b) via an editor, replace the existing splunk.license and splunk-fowarder.license file content with the key below and restart Splunk forwarder@splunk.com;JbX7lUZTDqk0tPNS7I0KEEdJ2tLJh0j++r6GOsx3jcxL3/nxvzL5Zx1uNEZjvdRPsqf1jnG1LoT/t8ouO7vGP75RX5G10CjQN3ED4yaE62KXcv8z1kbLD9JE31/tN/oUORTTqp8Nshst9/hN4qne9LWlxGZBz0XlQXQLOsIx5cLQdfb8WHtQ5OpNavlFSbzDBVcbewr/4nV7EtFgXTpm4ynNuE9b/JZ9glpYsV5qUgqULm/hzR2d6gteFvv5qN5zFnNYcUHnhP2FqCiSKyovzKLmy5a3yM8S682XJ8/a7FKwiFks7+XIsMVTjFv/tDg2DfE58HuRCWqkLb37mDu/yA== If you happen to see "Your license is expired" at the login screen, you can follow Option (1) above or continue with an admin login > select Enter a new license number > Continue > replace the existing forwarder@splunk.com license content with the above > select Save. Proceed to restart Splunk. If you continue to have license expiration issues, please log a Support case and include the license key for further investigation. ... View more

A Splunk Support case should be logged for further investigation. Thanks. ... View more

A Splunk Support case was logged for this issue. Summary indexing was not occurring on the search head due to an incorrect entry in $SPLUNK_HOME/etc/system/local props.conf which sent the summary index's stash files to the nullqueue. Removed in props.conf the stanza [stash] TRANSFORMS-set = setnull When you run a saved search with summary indexing turned on, its search results are temporarily stored in a file ( $SPLUNK_HOME/var/spool/splunk/<savedsearch_name>_<random-number>.stash ). There should not be a need to manipulate these temporary stash files. For further reference on summary indexing and backfill summary data gaps refer to the following: http://www.splunk.com/base/Documentation/latest/Knowledge/Usesummaryindexing?r=searchtip http://www.splunk.com/base/Documentation/4.1.5/Knowledge/Managesummaryindexgapsandoverlaps. ... View more

This is a known defect, SPL-31339: WinEventLog:Security logs stop getting indexed and Splunkd.log displays the following errors: ERROR WinEventLogChannel - initOld: Failed to initialize checkpoint for Windows Event Log channel 'Security' ERROR WinEventLogInputProcessor - main-thread: Failed to initialize Windows Event Log 'Security' This is likely due the Windows host not shutting down properly and the %SPLUNK_HOME%\var\lib\splunk\persistentstorage\WinEventLog\Security_checkpoint file is empty (size =1KB) The workaround is to shutdown Splunk on the Windows host, remove the file and restart Splunk to create a new Security_checkpoint file. This will allow the security logs to start indexing again. This defect is fixed in 4.1.4 (see http://www.splunk.com/base/Documentation/latest/ReleaseNotes/4.1.4) For 4.0.x, the fix is not currently planned and the workaround should be implemented. ... View more

Currently there is a limit of 250 owners to be listed in the drop down. In the jobs page, users can run a Search on their owner id to find their jobs as an alternative. ... View more

The same error message occurred when with another login with administrator’s group rights as well. Check the status of the WMI service via Start > Run > enter services.msc and check to ensure the Windows Management Instrumentation service has been enabled. Enable WMI and retry running msinfo32. There are many online references on how to resolve the Windows “Can’t collect information” message. In this case, the user found repairing WMI resolved their issue and thereafter installing Splunk was successful. ... View more

There is a Splunk web.conf attribute called "enable_autocomplete_login" which is affecting the behavior you are seeing in Firefox where the: "Do you want Firefox to remember the password for ...." never displays. It is related to the use of autocompletion. Starting with 4.0.7, this default setting was changed from True (enable) to False (disable) eg. enable_autocomplete_login = False To allow the browser to remember the password, modify the default setting and add into $SPLUNK_HOME/etc/system/local/web.conf in the [settings] stanza enable_autocomplete_login = True Note: do not change the $SPLUNK_HOME/etc/system/default/web.conf but create /etc/system/local/web.conf if it does not exist. Include the entry below and restart Splunk for this to take affect. [settings] # Enable/Disable Form Username and Password storage prompts and control form # data from being cached in session history. enable_autocomplete_login = True ... View more