Which dashboards are not populating? Typically it's because the fields have been changed, either due to an update by Verizon, or because the hostname might be coming in different than expected. Do me a favor and paste one of your events into this comment section and I'll see what can be the problem with your data. You can obfuscate your hostname and IP's, but leave the 'structure' in tact. ... View more

Are you still having trouble with this app? Have you tried troubleshooting the modular input on the forwarder? ... View more

The first thing I would do is get the data from the router to your Splunk server via syslog (UDP 514). Once you've accomplished that, then you can use the [netgear] source type, which I believe is closest to the way DDWRT logs the events, to start populating your data. If you want, you can post a sample of the events coming from your router to this post. I can then help you 'source type' that data. ... View more

You might want to check what version of Powershell you have. Do a Get-Host and see what version you have installed. I believe you want version 3.0+. ... View more

Have you tried installing the PowerShell Modular input on the search head and indexer(s)? (http://apps.splunk.com/app/1477/) Once you install that, then you want to make sure that the Powershell scripts are executing. Let me know if you have any issue with this, I was able to install it and get data. ... View more

I had this exact same issue and the way I resolved it was giving the authorization to the NT AUTHORITY account sysadmin privilege in the MSSQL Management Studio. This is a permission issue, so your best bet is to change the settings and then restart Splunk. Once it restarts, then run the Lookup Rebuilder and it should all work. Let me know if that works. ... View more

One of the first things I would check is the time on the server. This happened to me many times and I realized that the time on my forwarder was wrong which is why I was not seeing any data flowing to my indexer. Check out the link below and that might help you out. http://defaultreasoning.com/2009/11/16/synchronize-time-with-external-ntp-server-on-windows-server-2008-r2/ ... View more

First, don't try to just run the databases.ps1 script at the powershell command line, it will not run. It has to be run using the Invoke-Monitor script. The SA-Modularinput-Powershell is correctly added and it will actually read the stanzas from the TA-SQLServer/local/inputs.conf that specify 'powershell.' The way I resolved that issue was to go through the second part of my answer, which was to give the NT AUTHORITY SYSTEM account sysadmin privileges through the MSSQL Management Studio. Don't try and run the PS at a command line since it's basically calling the Common.PSM1 script which is why you're seeing the issue with the Import-LocalStorage. Here's another tip, once you have it correctly setup, you'll see the XML files show up in your $SPLUNK_HOME/var/lib/splunk/modularinputs/powershell/Databases directory. I hope that helps you out. ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITYSYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

http://apps.splunk.com/app/1810/ Here's the link to the above mentioned app. ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

Try re-installing the Splunk App for SQL Server. Once you've done that, and added all the files in their correct folders (TA-SQLServer, SA-PowerShell) in the etc\apps directory. After you've done that, then follow the instructions in the app to get it installed. After that's done, make sure to check out these next few steps to make sure it works in your environment: I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

I figured this one out, finally. Here's what I did: Windows Server 2008 R2 and Windows 2012 R2 - Open Powershell as Administrator PS C:\>Get-Execution Policy If it's Restricted, then do the following: PS C:\>Set-Execution Policy Bypass Say Yes to the Execution Policy Change. Then run Get-ExecutionPolicy and see that it changed to Bypass: PS C:\> Get-ExecutionPolicy Bypass Once you have that done, now you'll need to make one more change. Open your SQL Server Management Studio and log in as sysadmin (sa). Go to Security ->Logins -> NT AUTHORITY\SYSTEM (Properties) and grant the user sysadmin Server Role. Apply the change and restart your Splunk service. (Thanks Adrian: http://answers.splunk.com/answers/108974/problem-with-powershell-and-splunk_for_sqlserver-app) Once you have all these steps done, then go into the app and run the Lookup Table Rebuilder (Searches & Reports->Lookup Table Rebuilder) Lastly, you can run the search: index=mssql | stats count, values(sourcetype) by host You should see the following source types show up: MSSQL:Database:Health MSSQL:Host:Memory MSSQL:Instance:Service MSSQL:Instance:User Powershell:ScriptExecutionSummary ... View more

I was able to grant the access to the user by giving access to the role "splunk-system-role." The capabilities it has listed are: accelerate_datamodel accelerate_search admin_all_objects change_authentication change_own_password edit_deployment_client edit_deployment_server edit_dist_peer edit_forwarders edit_httpauths edit_input_defaults edit_monitor edit_roles edit_scripted edit_search_server edit_server edit_splunktcp edit_splunktcp_ssl edit_tcp edit_udp edit_user edit_view_html edit_web_settings embed_report get_diag get_metadata get_typeahead indexes_edit input_file license_edit license_tab list_deployment_client list_deployment_server list_forwarders list_httpauths list_inputs output_file request_remote_tok rest_apps_management rest_apps_view rest_properties_get rest_properties_set restart_splunkd rtsearch run_debug_commands schedule_rtsearch schedule_search search ... View more