I quite don't get it want you are saying here ¯\_(ツ)_/¯ First you say you cannot connect, then the servers are connected locally but no port open? So, does it work now or not? ... View more

Hi sbgoldberg13, I reckon it is permission related, make sure to configure the permission so the lookup is globally available - see the docs for more details https://docs.splunk.com/Documentation/Splunk/latest/Admin/Apparchitectureandobjectownership Hope this helps ... cheers, MuS ... View more

Check on the indexer if to port is open (assuming *nix so use `netstat -an | grep ) Check if there is a local firewall blocking the new port on the indexer Check if any other firewall is blocking the connection from your uf to the idx cheers, MuS ... View more

Hi mlevsh, Don't re-invent the wheel, take a look at the Monitoring Console inside Splunk Settings >> Monitoring Console it contains dashboards that will show exactly what you want. Read more about the monitoring console here https://docs.splunk.com/Documentation/Splunk/latest/DMC/IndexingIndexesandvolumes Hope this helps ... cheers, MuS ... View more

Hi nabhosal, There is no need to grant admin_all_objects to a user to access MC; you can create a new role with these limited capabilities: [role_mc-users] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 dispatch_rest_to_indexers = enabled importRoles = power;user license_tab = enabled list_deployment_client = enabled list_deployment_server = enabled list_forwarders = enabled list_health = enabled list_httpauths = enabled list_indexer_cluster = enabled list_indexerdiscovery = enabled list_search_head_clustering = enabled list_search_scheduler = enabled list_settings = enabled srchIndexesAllowed = _* srchIndexesDefault = _* srchMaxTime = 0 and allow this role read access to the Monitoring Console app. This will do the task. Hope this helps ... cheers, MuS ... View more

Hi vikram_m, you can create a new role with these settings: [role_mc-users] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 dispatch_rest_to_indexers = enabled importRoles = power;user license_tab = enabled list_deployment_client = enabled list_deployment_server = enabled list_forwarders = enabled list_health = enabled list_httpauths = enabled list_indexer_cluster = enabled list_indexerdiscovery = enabled list_search_head_clustering = enabled list_search_scheduler = enabled list_settings = enabled rest_properties_get = enabled list_health = enabled rest_apps_view = enabled list_indexer_cluster = enabled list_search_head_clustering = enabled edit_dist_peer = enabled srchIndexesAllowed = _* srchIndexesDefault = _* srchMaxTime = 0 and allow this role read access to the Monitoring Console app. This will do the task. Hope this helps ... cheers, MuS ... View more

Hi 340213, you can create a new role with these settings: [role_mc-users] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 dispatch_rest_to_indexers = enabled importRoles = power;user license_tab = enabled list_deployment_client = enabled list_deployment_server = enabled list_forwarders = enabled list_health = enabled list_httpauths = enabled list_indexer_cluster = enabled list_indexerdiscovery = enabled list_search_head_clustering = enabled list_search_scheduler = enabled list_settings = enabled rest_properties_get = enabled list_health = enabled rest_apps_view = enabled list_indexer_cluster = enabled list_search_head_clustering = enabled edit_dist_peer = enabled srchIndexesAllowed = _* srchIndexesDefault = _* srchMaxTime = 0 and allow this role read access to the Monitoring Console app. This will do the task. Hope this helps ... cheers, MuS ... View more

Hi LH_SPLUNK, take a look at this app here https://github.com/M-u-S/SA-LoadBalancerStatus (offical Splunkbase app is not yet approved). It provides a REST API endpoint that can be queried by the load balancer and based on the answer the instance will either be used or not. This is not exactly what you asked for, but this way the users would at least not land on a instance that is about to be restarted or such. Hope this helps ... cheers, MuS ... View more

Can you please mark this as accepted, thanks 🙂 ... View more

yep, you can use MAX_EVENTS = <integer> * Specifies the maximum number of input lines to add to any event. * Splunk software breaks after the specified number of lines are read. * Defaults to 256 (lines). if you are sure that this is correct and the one event is over 256 lines. ... View more

Hi tb5821, try these settings in the advanced settings of the add data UI: [ __auto__learned__ ] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true BREAK_ONLY_BEFORE=geo \{ I reckon the ^ in your regex does not work. cheers, MuS ... View more

Thanks for this, I notified the docs team to add this to the docs. cheers, MuS ... View more

And there is the common misunderstanding: btool does not show the actual config in use by Splunk, it merges all on disk config files and shows the potential configuration Splunk is using .... Quote from the docs: Btool displays merged on-disk configurations. That is, btool shows you the merged settings in the .conf files. It does not necessarily show you what Splunk software is currently using. link to the docs https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurations If you want to see the actual config Splunk is using right now, run this command: $SPLUNK_HOME/bin/splunk show config .... links to the docs https://docs.splunk.com/Documentation/Splunk/latest/Admin/CLIadmincommands It is a bit like in the old days with Cisco routers, there is a difference between running config and start-up config 😉 cheers, MuS ... View more

Hi morethanyell, two things I can think of: changes on inputs.conf most likely require a restart your p.s. solution is probably the solution anyway 😉 cheers, MuS ... View more

Hi everyone, There is now an app for this https://splunkbase.splunk.com/app/4377/ 😉 cheers, MuS ... View more

Hi there, There is now an app for this https://splunkbase.splunk.com/app/4377/ 😉 cheers, MuS ... View more

Hi there, There is now an app for this https://splunkbase.splunk.com/app/4377/ 😉 cheers, MuS ... View more

Hi there, There is now an app for this https://splunkbase.splunk.com/app/4377/ 😉 cheers, MuS ... View more

Hi there, There is now an app for this https://splunkbase.splunk.com/app/4377/ 😉 cheers, MuS ... View more

There is now an app for this https://splunkbase.splunk.com/app/4377/ 😉 cheers, MuS ... View more

Actually there is ONE good thing about running Splunk on Windows! When you are running Splunk 7.2.2 and later you don't have to worry about the systemd madness 😉 cheers, MuS ... View more

Hi bradp1234, I had a similar issue where the input stopped unnoticed for mare than 2 weeks, and once it was restarted the events were no longer available from the MS API :facepalm: It took me some time to troubleshoot the script/issue, but once I found who and where the checkpoint is accessed it was easy to manually check and update the checkpoint hidden deep inside this weird REST API / KV store construct. You can use this command to see the checkpoint: curl -k https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/ -u <username> And you can use this command to modify the checkpoint: curl -k --header "Content-Type: application/json" --request POST --data '[ { "state" : "{\"max_date\": \"2018-11-20 18:56:17.772814\"}", "_user" : "nobody", "_key" : "O365_<input name here>_checkpoint"}] ' https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/batch_save -u <username> Hope this helps should you have further issues ... cheers, MuS ... View more