One possible reason is the default stanza is disabled. Run below command to verify. ./splunk cmd btool --debug inputs list default If the return got a line saying 'disabled = 1', that is the culript. ... View more

Here is an example that shows how splunk monitors a file. Suppose we monitor this file. [monitor:///home/data/mylog.txt] After all the file content is indexed, you can issue this command to check the monitoring status. ./splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus -auth admin:changeme You will got a result like this: <s:key name="/home/data/mylog.txt"> <s:dict> <s:key name="file position">1542</s:key> <s:key name="file size">1542</s:key> <s:key name="percent">100.00</s:key> <s:key name="type">finished reading</s:key> </s:dict> </s:key> which means 100% of the file is read and the pointer is at 1542 bytes. So, where does Splunk store this information? It is in the fishbucket. If you issue this command to check against the fishbucket: ./splunk cmd btprobe -d /opt/splunk613-b/var/lib/splunk/fishbucket/splunk_private_db --file /home/data/mylog.txt You get this result: key=0x4cb806285f84f0d9 scrc=0xdeb7db35f8958745 sptr=1542 fcrc=0x61910b3b6da87f06 flen=0 mdtm=1413872354 wrtm=1413872518 You will notice that the fishbucket doesn't have any filename information. Fishbucket doesn't store filename information. It only stores the crc of that file. The key to the monitoring file /home/mylog.txt is key=0x4cb806285f84f0d9 So, how is /home/data/mylog.txt and key=0x4cb806285f84f0d9 related? Here is the command. # ./splunk cmd btprobe --compute-crc /home/data/mylog.txt Using logging configuration at /opt/splunk613-b/etc/log-cmdline.cfg. crc=0x4cb806285f84f0d9 decimal=5528175313068290265 ... View more

If you are sure your password is correct, check whether your password contains any special character. You can temporary change your password to simple text to verify. ... View more

Here are the steps to check what exact search splunk is using when connecting to AD. Enable the following debug ScopedLDAPConnection = DEBUG AuthenticationManagerLDAP = DEBUG From the splunkd.log, you will see record like this. 10-31-2014 10:33:13.785 +0800 DEBUG AuthenticationManagerLDAP - Attempting to get user information for user="splunk_network_test" from strategy="ldap_group" 10-31-2014 10:33:13.785 +0800 DEBUG ScopedLDAPConnection - strategy="ldap_group" Initializing with LDAPURL="ldap://10.10.10.10:389" 10-31-2014 10:33:13.785 +0800 DEBUG ScopedLDAPConnection - strategy="ldap_group" Attempting bind as DN="CN=ldapadm,CN=Users,DC=splunkldap,DC=com" 10-31-2014 10:33:13.788 +0800 DEBUG ScopedLDAPConnection - strategy="ldap_group" Bind successful 10-31-2014 10:33:13.796 +0800 DEBUG ScopedLDAPConnection - strategy="ldap_group" Attempting to search subtree at DN="CN=Users,DC=splunkldap,DC=com" using filter="(&(samaccountname=splunk_network_test)(objectclass=user)(displayname=*))" 10-31-2014 10:33:13.824 +0800 DEBUG ScopedLDAPConnection - strategy="ldap_group" Search duration="27.32 milliseconds" 10-31-2014 10:33:13.824 +0800 DEBUG ScopedLDAPConnection - strategy="ldap_group" LDAP Server returned no entries in search for DN="CN=Users,DC=splunkldap,DC=com" filter="(&(samaccountname=splunk_network_test)(objectclass=user)(displayname=*))". 10-31-2014 10:33:13.824 +0800 ERROR AuthenticationManagerLDAP - Could not find user="splunk_network_test" with strategy="ldap_group" Use the filter from the debug log to run the ldapsearch again to check. filter="(&(samaccountname=splunk_network_test)(objectclass=user)(displayname=*))" ... View more

How about this searach. index=_internal | bin _time span=1h | stats count by _time sourcetype|timechart span=1h sum(count) by sourcetype limit=500|fillnull ... View more

Add a record to /etc/hosts resolved this. /etc/hosts 10.10.10.1 centos62-64sup03 ... View more

It is because the custom search command (return) is in the search app, the new role role_demo needs read access to the search app. Go to Manager > Apps > Search > Permissions and then grant the read permission to role_demo to fox this. ... View more