Hi, check that you don't have ANNOTATE_PUNCT=false under the iis_log sourcetype in props.conf (see https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf ) you can check from command line with a command such as splunk btool props list iis_log --debug |grep -i annotate_punct (replace iis_log by your sourcetype as necessary) BTW, you probably mean 7.1.3 as 7.2.3 doesn't exist yet. ... View more

hello, you cant remove a site like this because there will be buckets from the removed site that are replicated to the site you keep -> splunk will (really) complain about this. but since 7.0, you can decommission a site with this method by aliasing the decommissioned site : decommission a site then depending on the target, you could use the offline indexer procedure from doc ... View more

just had the same error message on a standalone test instance in a VM. looking at internal log, the root cause is disk space ... View more

Try : index=* | bin _time span=1d | stats count by port,_time | timewrap 1d with a timerange of 2 days ... View more

you need to clone in order to have one pristine and one transformed event. Either by using the CLONE_SOURCETYPE or by cloning to a separate instance (HF) that will do the SEDCMD + send as syslog ... View more

I think Splunk complain because you don't specify any time in your datetime.xml so you should add something that just set a time to a known value (perhaps at 00:00:00) 1 <define name="Your Custom Name Time" > 2 <text>set your time to 00:00:00 here</text> 3 </define> 4 5 <timePatterns> 6 <use name="Your Custom Name Time"/> 7 </timePatterns> ... View more

This config is search time only Time should be set at index time. ... View more

Hi, I had the same problem and from what I understand the explanation is as follow : - ES used to have to change right to authorize.conf but the way it was done was not ideal. - ES 4.7 migrate the old configuration to a new config which remove the original need. - the migration script has no way to know that the changes to authorize.conf where done by ES -> don't touch them as they could be legitimate otherwise. - ES permission checks detect the too open permission and warm about So the current solution would be to manually go on each app in metadata/local.meta , look for authorize.conf stanza and remove non admin right on it as appropriate to your env. Hope that helps. ... View more

Hi, have you cloned the UF as it would explain why you only see one ? if that's the case, use the splunk clone-prep-clear-config read http://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Makeauniversalforwarderpartofahostimage for more info. If that's not the case look for duplicate value in the name /clientname sent by your UF ... View more

your config looks good to me try index=_* | chart count by splunk_server . Does it also return results on one search head ? also check you don't have a search group configured on the SH with only one indexer (do a btool on distsearch.conf for checking this) ? if so, just remove it from the config, you are not using any multisite mode (then you could have afinity between sh and one indexer) -> so unlikely this is the cause as you have multiple nic, your indexer may report a unreachable search ip to the CM On each indexer, I would force the search ip in server.conf (look for register_search_address = IP address in server.conf) I would start by setting this. ... View more

Hi, I think you need the root certificate used by splunk cloud in your local java/os.-> your java app doesn't trust the HEC port -> you cant connect you can use openssl s_client for example to check/debug your SSL connection (code 19 = you need to specify the root, code 0 = verified) ... View more

you can restrict data model age. you can create a volume for data model and use splunk volume management to limit disk space. look at indexes.conf spec you will need : - one volume with the limit (by indexer) - reference that volume for tsidx on index don't set the limit too low or that would probably clean up too much accelerated data. ... View more

One possible scenario to explain your problem : - specifications or configuration is different on that indexer -> he has more work to do OR it is less powerfull than others - at some times, you are creating more search load that the indexer can handle -> load spike on this indexer - this indexer is now slow to respond to sh -> the search head thinks it's down So I would : - investigate why that indexer is different than the others - check search concurrency limit on sh and if needed lower it (lower shedule perc may be enough) - spread your search load over time (schedule window, continous scheduling, skew, ..) ... View more

Hi, Have you checked that your script produce UTF-8 ? If not, you probably need to specify the charset associated to the sourcetype used in your monitor stanza so that splunk can convert the text to UTF-8 (so in inputs.conf , you monitor your file and used sourcetype1 (as a example) , in props.conf, you specify CHARSET for this sourcetype1 used.) ... View more

As you have a indexer running 6.6, you'll need to upgrade your 6.2 SH to 6.6 to be in a supported configuration. Currently your 6.2 SH has problem talking with the 6.6 IDX, which explain the difference in your results. As a rule of thumb, SH>=IDX version see http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Distsearchsystemrequirements for more info ... View more

100054, means "Socket forcefully shut down by remote host" I've a similar error message on some UFs and it looks like this is du to a network problem (ie a very short network cut that would force the TCP session to be reset (because of network unreachable returning to host for example that would immediately break the session) but it is a generic network error so that's not the only possibility. ... View more

Hi, has somebody made this work with 6.5 or 6.6 ? I don't see any effect after modifying this file so I'm not sure it's still used by these versions in default webserver configuration ... ... View more

this is a search time settings so will have no effect on a indexer (but should be in a TA which will be deployed on both SH and IDX) ... View more

HI, I don't think that's possible to have specific replication settings by index but that would certainly cover that and other more complex replication topologies. Currently the only possible settings is to replicate or not a index but that's probably not what you wan't to achieve. I would suggest you to fill a enhancement request for the feature you need. ... View more

Hi, I'm afraid there's no easy solution. your configuration looks good but doesn't apply because winevent log collection is done in a structured way -> so data is going out of your UF already parsed ... when received later on (on a HF for example which can send syslog) -> splunk doesn't reanalyze the data twice. but the original UF can't directly send syslog... so you should : - keep a uf for collection - send your data normally up to your indexer(s). - somewhere between your uf and indexer(s), clone the data (a uf can do it) and send it to 1 or more specialized HF that will do the syslog and other specific things (ie transforms) you'll need to make windows event fit in syslog (because that's not natural to make multiline go in a protocol which is traditionally for one line events...) - apply your syslog stuff above on the specialized HF/Syslog look at this post as a guideline https://answers.splunk.com/answers/5528/forwarding-select-data-in-my-environment.html beware that you should not modify the settings before cloning as setting the route parameters on input should normally not be modified.(because it's easy to break things this way) Good luck and happy splunking ! ... View more