I'll get a bug opened up on this.. ... View more

By default, the Splunk Java SDK will use SSLv3 to connect. You will need to change this to TLS per the following instructions. This will be changed in a future release. You will have to modify HttpService.java and change the following lines: SSLContext context = SSLContext.getInstance("SSL"); to SSLContext context = SSLContext.getInstance("TLSv1.2"); public static final String[] PROTOCOLS = {"SSLv3"}; to public static final String[] PROTOCOLS = {"TLSv1.2"}; You will have to recompile the jar and redeploy it as well. ... View more

Unfortunately this is something that is outside of the control of Splunk. We cannot ensure that applications like LastPass or Keepass work with our application. Though it would be useful to know if dfronck's answer works for anyone else. Brian ... View more

CAPS LOCK ISN'T CRUISE CONTROL FOR COOL. But, the link is the same as the answer, it provides information. There is no 100% guarantee that any answers here will solve your problem. This is a free community support answers board after all. You want 100% accurate answers, you will need to pay for support. That being said, the answers provided are the correct ones. ... View more

My issue was a different issue - with HP-UX install, LD_LIBRARY has to be set before attempting any CLI commands. Rajpal again rocks the house. ... View more

I've been able to recreate it on my side using the following: Clean install of Splunk 6.2 Update server.conf with the following: cipherSuite = AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384 Restarted Splunk Ran the following command: [root@bporepo01 local]# /opt/splunk/bin/splunk list monitor Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Re-opening the bug. ... View more

To add to this answer, we do not recommend you use a load balancer between your forwarders and indexers. The problem is (especially if you have multiple indexers), the load balancer will not know what the end of an event looks like. You would end up with truncated events, and a mess of your data. ... View more

Erick, At this time you cannot extract time from the filename - only the date. Brian ... View more

Just to expand on what Vinay posted: If you are running 6.0.x or 6.1.x, you will have to upgrade to 6.1.4 to fix this issue. If you are running 5.x, you can upgrade to 5.0.10 to fix this issues. If you have any questions, please let me know. ... View more

Update to the bug All, Here is the latest on this bug. When a date is selected in the GUI time range picker, we send the date to the backend (splunkd) in the in the format (mm/dd/yyyy). The backend then converts it to epoch time and returns the epoch time to front end (splunkweb). The front end then validates that the earliest time is truly earlier then the latest time. What happened is that on Saturday, 09/06/2014 - we passed a magic point where the epoch time returned 1410065408, which is (10^10)%(2^32). Due to a bit of difference between the way Windows handles unsigned integers (it considers them 32 bit vs 64 bit), the value passed was being truncated. So all in all, what does this impact? Any 32-bit install of Splunk - Windows & Linux 64-bit installs of Splunk - Windows This includes versions 5.x,6.x, and 6.1.x of Splunk. The developers are looking at creating a patch for this - I will let you know once we have a better time frame. Brian ... View more

Jan - Are cyberark's logs in a text format? I used it at my last job and don't remember if that's the case. If it is, it would be a simple matter of installing a forwarder on the Cyberark server and pointing it at the logs. Then you would have to set up field extractions. Brian ... View more

Can you open a ticket up and email [email protected] the ticket number? ... View more

I've found some issues around the Deployment Server and how it handles missing applications - which may be part of the problem here. I've opened bug SPL-85551 and will let you know what is found. ... View more

This has been identified as a bug in SPL-84446 and will be fixed in an upcoming version. Brian ... View more

This is a known issue and is being looked at by the developers. Brian ... View more

All - If you have enterprise support, can you please open a support case and create a diag ( see information here - http://docs.splunk.com/Documentation/Splunk/6.1/Troubleshooting/Generateadiag ) and email [email protected] the ticket number? Brian ... View more

Can you elaborate on the steps you took to upgrade? Did you upgrade the search heads first or the indexers? Did you restart after upgrading? What OS are you running it on? ... View more

What version were you upgrading from? By search peers, you mean your indexers? Were you trying to log into them directly? ... View more

This is a known bug and will be fixed in the next release.. ... View more

It really shouldn't of overrided the configurations if you have things in local. Do you have enterprise support? If so, can you get a ticket opened up and let me know the ticket number.. ... View more

Did you put your configuration files in the default directory vs local? ... View more