Need a little more context, if you would, please? You say this is with the Splunk App for Windows, but that app has no such functionality. So I'm presuming that you are doing this from within Splunk itself. Could you give me a list of the steps you are taking to get to this error message? A screen shot would be great, too, thanks. ... View more

The error in the documentation has been fixed. Splunk does support AIX 6.1. ... View more

Please open a support ticket and explain the steps you took which got you to this error when you submit the ticket. http://www.splunk.com/support ... View more

Okay, that's cool. But, if you would, please open a ticket with Splunk support anyway and reference all the information on this page, including what you had to do to get splunkweb to start correctly. Thanks! ... View more

Okay, can you make a copy of that folder (and all its contents) and rename it to "Windows_IFrame" and let me know what happens? Were you running the Windows app prior to your upgrade? ... View more

This problem is now fixed and the page is available for Version 2.0. This topic didn't inherit properly, which is why it didn't exist for v2.0 before. Apologies for the inconvenience! ... View more

Docs updated. ... View more

That typo has since been fixed. ... View more

You should be set. If you're not seeing Splunk App for Unix and Linux data, there are a couple of possibilities as to why: your forwarding and receiving is not set up correctly. the Splunk TA for Unix and Linux is not installed correctly (it must be in $SPLUNK_HOME/etc/apps/Splunk_TA_nix on the computer that you want to collect data from) you aren't looking in the right index for the data (the Splunk App for Unix and Linux puts data into an index called 'os') Check $SPLUNK_HOME/var/log/splunk/splunkd.log on the VM for clues as to why data is not getting into your full Splunk instance. ... View more

Hi, To get data from a remote Linux VM, you have to forward that data to your Splunk App for Unix and Linux instance using a universal forwarder. Configure the Splunk App for Unix and Linux instance to be a receiver. Download and install the universal forwarder on the Linux server that you want to get data from. Configure the universal forwarder to send data to your Splunk App for Unix and Linux instance. Manually install (and configure) the Splunk TA for Unix and Linux on the Linux server that you want to get data from, as you attempted to before. Your Linux server's data should then appear in the Splunk App for Unix and Linux instance. Also: I've fixed the typo in the documentation. It's okay if the 'local' folder doesn't exist, you can create it and that doesn't mean there's anything wrong. 🙂 Relevant reading: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutforwardingandreceivingdata http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deployanixdfmanually Cheers! ... View more

Documentation updated. ... View more

Are these drives that "need user authentication" mapped as network drives? If so, then you need to install Splunk as a user that already has at least read access to those volumes/drives. Splunk can only authenticate with the username and password that you give it at installation. More info here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindows#Choose_the_user_Splunk_should_run_as http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata ... View more

Hi, There are many reasons why you might experience this error. Have you installed your Splunk instance as a user with appropriate access to the performance monitoring objects you are trying to monitor (not "Local System")? Have you granted the user that you installed Splunk as appropriate permissions to the performance objects you want to monitor? Are all machines in the same domain? More information here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindows#Choose_the_user_Splunk_should_run_as http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata ... View more

Hi, Can you try downloading the package again and seeing if you continue to get the errors? ... View more

So I just wanted to provide an update to this. After some internal discussion, I've decided to open a bug on this issue. While we are not convinced that Splunk is generating invalid data, we are investigating whether or not the data being returned by WMI is valid. We have, so far, concluded unequivocally that splunk-wmi does, in fact, return non-zero data for average- and per-second performance counters gathered against the local WMI namespace. The questions that remain are: How reliable or valid is this data? How is splunk-wmi presenting this data? Once our investigation is complete, I'll post an update here. In the meantime, there are ways to work around this possible issue: Use a universal forwarder to collect data from your remote Windows machines, instead of a light forwarder. Use performance monitoring inputs to get your data, instead of WMI. Cheers. ... View more

Can you tell me which version of Splunk you are using? Thanks. ... View more

Hi, When collecting performance metrics from a local machine, you should not use splunk-wmi. You should use splunk-perfmon. Splunk-perfmon attaches directly to PDH to poll the performance objects and counters directly. In any case, whenever you use WQL, your query must be syntactically correct, including case, punctuation and spacing. Failure to maintain a correct WQL query structure will result in no data being returned. Just to make sure that this was not a bug, I tested your WQL query with WBEMTEST. It returns the same results. More information on collecting performance metrics is here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Real-timeWindowsperformancemonitoring Cheers. ... View more

Hi, From the looks of things it appears that your splunk-wmi command is not attaching to WMI properly. At the very least, Splunk needs to run as a user that has access to WMI. It also needs to be correctly configured to connect to WMI. Review the following documentation at your leisure for specifics about how to attach to WMI sources to get data: http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata (for information on how to connect to WMI sources to get data from WMI) http://docs.splunk.com/Documentation/Splunk/latest/Data/Real-timeWindowsperformancemonitoring (to learn how to use Splunk's performance monitoring tools, which use WMI-based inputs in some situations) http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata (for general information on monitoring remote Windows data) Cheers. ... View more

Hi, Are you seeing this right after you upgrade? Where (in what context) are you seeing this? ... View more

Does this server hold all of the Exchange server roles? ... View more