rgsurfs, I'm a little late to the party - I stumbled across this looking for 'DOD cert' answers. When you upgraded your forwarders to 6.3.2, was Splunk enterprise also updated to that version first? I remember a conversation a long time ago with a Splunk engineer: make sure that your Splunk forwarder version is <= to the Splunk enterprise version. Otherwise....bad juju. ... View more

Splunk is running as 'splunk' The rpm upgrade is running as 'root' What should I look for in /etc/init.d/splunk ? A side note on this: the server was running Splunk as 'root' when I first looked at it. I changed the permissions so that the user 'splunk' would run it instead. ... View more

That did it....just needed the right SplunkFu! Thanks for the help martin_mueller! I'll reach out to the Splunk Add-on for Windows app developers and mention it to them. ... View more

Yes - I could have been clearer. I'll edit the question. ... View more

Just to clarify on this - the script is getting me what I expect and the events actually do show the whole DisplayName value. When I do the query, I don't get the whole DisplayName value. ... View more

Sure - the script is from the Splunk Add-on for Windows app (win_installed_apps.bat): @echo off REM -------------------------------------------------------- REM Copyright (C) 2005-2011 Splunk Inc. All Rights Reserved. REM -------------------------------------------------------- setlocal EnableDelayedExpansion REM For each app key, print out the name of the app and any parameters under the entry for /f "tokens=*" %%G in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" ^| findstr "Uninstall\\"') do (call :output_reg "%%G" 72) REM Do the same as above but with 32-bit apps, first checking if the key exists reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" >nul 2>&1 if %ERRORLEVEL% EQU 0 ( for /f "tokens=*" %%G in ('reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" ^| findstr "Uninstall\\"') do (call :output_reg "%%G" 84) ) goto :eof :output_reg REM Echo an empty line to indicate that this is a new entry @echo. REM Get the current date into a variable for /f "tokens=*" %%A in ('date /t') do for %%B in (%%A) do set date=%%B REM Get the current time into a variable set time = 'time /t' for /f "tokens=1,2 delims=." %%A in ("%time%") do set time=%%A REM Print out the date & time @echo %date% %time% REM Add the enumerated key @echo Installed application enumerated from %1 REM Get the name of the app from the last segment in the registry path set app_name=%1 REM Strips out the first x characters (from input) of the path in order to get just the app name set "app_name=!app_name:~%2%,150!" REM Strip the last quote set app_name=%app_name:~0,-1% REM Store a count value so that we can avoid printing the first entry set count=0 REM This variable determines if the display name was found set display_name_found=0 REM Now get the sub-keys for /F "tokens=1,2*" %%A in ('reg query %1') do ( set /a count+=1 REM Skip the entry if it just repeats the name we are querying for or if it is blank or if is "<NO" (which indicates the item has no name) if not "%%A" == %1 if not "%%A" == "" if not "%%A" == "<NO" echo %%A=%%C REM Note that the display name was already found if %%A==DisplayName set /a display_name_found=1 ) REM If the display name was not found, then use the name of the registry path name instead if !display_name_found!==0 echo DisplayName=%app_name% ... View more

6) When you convert an indexer to a cluster peer, disk usage will go up significantly. Make sure that you have sufficient disk space available, relative to daily indexing volume, search factor, and replication factor. For detailed information on peer disk usage. 7) Cluster nodes cannot share Splunk Enterprise instances. The master node, peer nodes, and search head must each run on its own instance. Also , I will suggest you to refer folliong links i) “Migrating from a non-clustered Splunk Enterprise deployment?” at link http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Aboutclusters ii) http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Upgradeacluster iii) Here is good information on Cluster to Bucket: -----http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Bucketsandclusters ... View more

Thanks Steve G. In case anyone out there is interested, I posed the same question to Splunk support and this was their answer: If you are planning to move from Non Cluster environment to cluster environment , here are some of the key points to watch out for when enabling Cluster Replication from indexer 1) Also, it is required that in clustered environment all the splunk instance like Cluster Master, Clustered indexer and Clustered Search head need to be on exact same Splunk Version. 2) In clusrted environment one of the requirement is to keep all the conf files in synch ( example indexes.conf,inputs.conf etc ) . As a result to deploy the Application and config files to indexer you will need to use Cluster Master “Deploy Bundle” 3) Also, you are correct Deployment Server cannot be used to deploy Application to the Clustered indexer and Cluster Master. For other splunk instance like Search Head and Universal Forwarder you can still continue to use Deployment Server. 4) For clustered environment you will need Cluster Master, Cluster Peer and Search Head that is enabled from clustering. 5) Although not required you should enable indexer acknowledgment for the forwarders sending data to the peer. Refer: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Useforwarderstogetyourdata#How_indexer_acknowledgment_works ... View more

Thanks for the input thomrs. ... View more

Looks like my link above didn't work. Here it is again: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Keydifferences ... View more

casey18cc - did you install the cert on the search head or the indexer? ... View more

You may want to take a look at this: http://answers.splunk.com/answers/179891/why-are-no-results-displaying-in-cisco-estreamer-f.html ... View more

Thanks jconger. I was having the same issue and this worked like a charm! ... View more

Thanks Ellen. ... View more

So I've commented out the "whitelist = 1000-1010" line from the server and desktop apps as I stated previously (on the local directories inputs.conf - as stated by jconger), but I still don't see any application logs other than the ones on the whitelist (1000-1010). I don't see any information logs (which is good - don't want those), but there have been other application log warning events since then that have not been logged. I restarted the indexer. Any other ideas? ... View more