About ShaneNewman

ShaneNewman · ‎12-31-2013

This is the message I got back from Splunk Support. It looks like this behavior has been identified as bug SPL-76980 and a code change has already been made that should resolved the issue, being included tentatively in version 6.0.2.

ShaneNewman · ‎12-29-2013

I assume you work for a hospital company, seeing as your name has hospitals in it. If you do, PM me. I currently manage the Splunk deployment for the largest Healthcare Company in the US. Depending on the scope of work, I may be able to point you in the right direction.

ShaneNewman · ‎12-29-2013

We have files that are not being indexed, yet they are seen by Splunk. We have 38 files FTP'ed to a file folder which Splunk monitors every hour. Each hour, the previous 24 hours worth of data is dumped, just in case the job does not run as expected, this keeps us from having data loss. Being this way, we know that Splunk sees the old data as duplicate data, so we use this config to solve it: [monitor://E:\inetpub\ftproot\NPR\PROD] sourcetype = meditech_npr index = capsule_npr crcSalt = <SOURCE> Until the upgrade to Splunk 6/6.0.1, this has worked fine, it no longer appears to work though. It is of extreme importance that this issue is resolved immediately. Currently, I am having to delete the entire _thefishbucket index every few hours to ensure that data is getting indexed properly. Any help would be greatly appreciated!

ShaneNewman · ‎12-19-2013

Easy enough, just use sub-searches in your search string. There is no real reason to create a temp index, you are just adding another failure point.

ShaneNewman · ‎12-18-2013

We saw the same thing on our AIX indexer. Every time we restarted the instance it would crash within 5-10 minutes. After dealing with this for about 3 days, we upgraded to 6.0 and that did not help either. One of my co-workers put in a ticket with Splunk, nothing useful ever came of it though. At the end of the day, we ended up converting that server from an indexer to a heavy forwarder. It has been up for 2 months now with no issues. We still have it doing all of the extractions and reassigning indexes/sourcetypes based on eventtypes and regex matches, the only change was to stop indexing on that server. You can always submit your own ticket to Splunk, go to the /opt/Splunk/bin directory and run splunk diag. This will give you a rather large file to upload to your support ticket, if your company does not pay for support... be prepared to wait a few days for a response.

ShaneNewman · ‎12-18-2013

I have several summary indexes that do this. The most important thing, should be fairly easy, is to figure out a time span. This is a saved search template I use to populate summary indexes capturing data you described above: [savedsearchname] enableSched = 1 cron_schedule = */5 * * * * dispatch.earliest_time = -8m@m dispatch.latest_time = -3m@m action.summary_index = 1 action.summary_index._name = sum_index action.summary_index.stat_tag = statistics search = index=your_index sourcetype=your_sourcetype | bucket _time span=1m | sistats\stats avg(your_field) AS your_field_avg, median(your_field) AS your_field_median, mode(your_field) AS your_field_mode, count(your_field) AS your_field_count, dc(your_field) AS your_field_dc, max(your_field) AS your_field_max, min(your_field) AS your_field_min, stdev(your_field) AS your_field_stdev, var(your_field) as your_field_var by _time You can use a macros.conf to make the search look cleaner, as I do. I just wrote it all out to show how to set up the values you need using sistats. As you can see above, this data is on (up to) an 8 minute delay from real-time. You can adjust the delay by changing the earliest_time and latest_time parameters. Also, when getting data back out after using sistats, you will need to rerun the stats command to "reheat" the data for use.

ShaneNewman · ‎12-15-2013

[SourceTypeName] FIELD_DELIMITER = "|" CHECK_FOR_HEADER = true HEADER_MODE = firstline

ShaneNewman · ‎12-03-2013

I agree, if it is re-indexing files of that size, that is a bug.

ShaneNewman · ‎12-02-2013

This isn't so much of a question as it is informative. We recently got a copy of Splunk 6.0.0.2, do not use it on Windows Server 2003! We installed it on 3 different servers, it corrupted the registries on each one of the servers. Splunk has confirmed that it is a bug in the installer package and they are working to correct it. In the mean time... Just don't do it, we had to completely rebuild the boxes before we could install anything on the boxes, splunk related or not. It does work fine on the WS2008 and WS2008R2 boxes.

ShaneNewman · ‎12-02-2013

I think everyone has this issue. It is actually there to make sure that if the logs roll over and keeps the same name, it doesn't see the file as a duplicate. Chances are, if you see this, those files are extremely small and shouldn't really impact your indexing license unless you have hundreds of thousands of files that single UF is monitoring (not going to happen). We have hundreds of files being monitored via a Heavy Forwarder and we get this message anytime it is restarted. Unless we clean the fish bucket before we start the instance, the most I have seen re-indexed from a restart is about 15MB.

ShaneNewman · ‎12-02-2013

I had to rerun the lookup search to create the lookup file manually after this. Once I did that, everything started working fine!

ShaneNewman · ‎12-02-2013

I only know how to do this in advanced XML. First, you will have to schedule the saved search and make it visible to the app that you have created the report/dashboard in. Once you have it scheduled, make sure it runs once before you go to the dashboard. In the dashboard XML file, add something to this effect in the appropriate location: <module name="HiddenSavedSearch"> <param name="savedSearch>your saved search name here</param> <param name="useHistory">true</param> The rest of your modules will go here </module> If you want the query to run as someone loads the page then it will be more like this: <module name="SavedSearch" autoRun="True"> <param name="savedSearch>your saved search name here</param> The rest of your modules will go here </module> Make sure that the saved search that you create looks like this: | dbquery "select * FROM your_database.your_table" | any other stuff here... It is very important that there is a pipe before dbquery or it will not work. Just FYI, I have had issues with putting "|" in macros and saved searches. It might be an issue with having the pipe in the saved searches. You may also not have the dbx modules needed shared with the proper app. If none of these work for you, let me know.

ShaneNewman · ‎11-30-2013

I assume you restarted the instance and deployed this to the forwarder and indexer both?

ShaneNewman · ‎11-30-2013

Is there a chance you have used search optimization? If you have, splunk creates a summary index, meaning the historical data will still be in that summary index.

ShaneNewman · ‎11-30-2013

According to regexpal.com your regex matches this: 1385832300000|325447|NormalizedCPUInfo|Utilization|3|CPU|IVEblah|CPU 1 The matched parts are bold. The current regex is not using "|" correctly as or. Everything needs to be inside a single set of brackets. If you want to match only the events you have specified then your regex will need to look more like this: [setparsing] REGEX = ^(\w+\|){6}[FIL|Ww|Cc|Ii|Pp|Ss|Ii|Vv|Ee] DEST_KEY = queue FORMAT = indexQueue

ShaneNewman · ‎11-27-2013

Can anyone give any feedback on this?

ShaneNewman · ‎11-27-2013

There is a bug in Splunk 6.0.0.2 pertaining to WS2003R2. There has been a bug ticket created and they should have more information by 12/3/2013. The bug apparently corrupts the registry and keeps splunkweb from installing. The only way to resolve this was to delete the services manually, then reinstall Splunk 5.0.5. Splunkweb will still not load, it does give the ability to at least get the services up and running though.

ShaneNewman · ‎11-27-2013

I created a critical ticket with Splunk. Turns out we needed to deploy the pre-release of Splunk. The issue then, was that Splunk 6.0.0.2 does not work on WS2003R2 and a bug has been filed.

ShaneNewman · ‎11-26-2013

We upgraded to 6.0 yesterday. Since then, randomly, we see this: [build 182037] 2013-11-26 15:01:46 Access violation, cannot read at address [0x0000000014F00000] Exception address: [0x000000000037C5F4] Crashing thread: HTTPDispatch MxCsr: [0x0000000000001F80] SegDs: [0x000000000000002B] SegEs: [0x000000000000002B] SegFs: [0x0000000000000053] SegGs: [0x000000000000002B] SegSs: [0x000000000000002B] SegCs: [0x0000000000000033] EFlags: [0x0000000000010206] Rsp: [0x000000000287FA68] Rip: [0x000000000037C5F4] memmove + 628/1280 Dr0: [0x0000000000000000] Dr1: [0x0000000000000000] Dr2: [0x0000000000000000] Dr3: [0x0000000000000000] Dr6: [0x0000000000000000] Dr7: [0x0000000000000000] Rax: [0x000000000000000B] Rcx: [0x000000000BFE0518] Rdx: [0x0000000008F1FAE0] Rbx: [0x00000000104FD3D8] Rbp: [0x0000000000003FD8] Rsi: [0x000000000BFE0038] Rdi: [0x0000000000003FD8] R8: [0x0000000000003FD8] R9: [0x00000000000001D7] R10: [0x000000000000000B] R11: [0x000000000BFE0038] R12: [0x0000000000000002] R13: [0x0000000000000002] R14: [0x0000000000000002] R15: [0x0000000000000000] DebugControl: [0xFFFFF80001024D4A] LastBranchToRip: [0x0000000000000000] LastBranchFromRip: [0x0000000000000000] LastExceptionToRip: [0x0000000000000000] LastExceptionFromRip: [0x0000000000000000] OS: Windows Arch: x86-64 Backtrace: [0x000000000037C5F4] memmove + 628/1280 [0x000000000FBD0371] FINGERPRINT_premain + 10145/33104 [0x000000000FBCFEC7] FINGERPRINT_premain + 8951/33104 [0x000000000FBCE4E5] FINGERPRINT_premain + 2325/33104 [0x000000000FBCF175] FINGERPRINT_premain + 5541/33104 [0x000000000FBB83E5] COMP_rle + 709/2272 [0x000000000FBB7FC7] COMP_compress_block + 55/80 [0x000000000048468A] SSLv3_client_method + 38346/47744 [0x0000000000480EC7] SSLv3_client_method + 24071/47744 [0x000000014079D9C9] ? [0x00000001407A0C0C] ? [0x00000001407A091F] ? [0x000000014079CADB] ? [0x0000000140026D2C] ? [0x00000001406F720E] ? [0x0000000140029537] ? [0x0000000000363FEF] beginthreadex + 263/284 [0x0000000000364196] endthreadex + 402/404 [0x0000000077D6B70A] BaseThreadStart + 58/80 Crash dump written to: C:\Program Files\Splunk\var\log\splunk\C__Program Files_Splunk_bin_splunkd_exe_crash-2013-11-26-15-01-46.dmp TRDVWPTRM01 /5.2 Service Pack 2 GetLastError(): 0 Threads running: 113 argv: [Splunkd -p 8089] Thread: "HTTPDispatch", did_join=0, ready_to_run=Y, main_thread=N First 4 bytes of Thread token @00000000023BD344: 00000000 88 07 00 00 |....| 00000004 First 128 bytes of CompletionPortItem object @000000001203F560: 00000000 18 af 15 41 01 00 00 00 50 b7 34 25 00 00 00 00 |...A....P.4%....| 00000010 38 96 26 41 01 00 00 00 01 00 00 00 00 00 00 00 |8.&A............| 00000020 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000040 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 |................| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 40 97 da 11 00 00 00 00 00 00 00 00 00 00 00 00 |@...............| 00000070 00 00 00 00 00 00 00 00 47 45 54 20 2f 73 65 72 |........GET /ser| 00000080 In TcpChannel 000000001203F560, _tcloop=000000000166FC18, no async write data, _data._shouldKill=N, r/w_timeouts=5000/300000, timeout_count=0 SSL: version="SSLv3", state="SSL negotiation finished successfully", cipher="AES256-SHA", compression="zlib compression" rbuf: ptr=000000001203F5D8, size=0x2000, rptr=0x0, wptr=0x0 TcpChannelAcceptor: pendingAsyncAccept=1, dyingChannels=0, tcloop=000000000166FC18, activeList=000000001F34F230, activeCount=10, idleThreads=0000000013CCF058, idleThreadCount=43, activeThreadCount=9, maxActiveThreadsInTimePeriod=27, idleThreadTrimmerActive=Y, disabledReasons=0 _thread=000000001401B958: commandForThread=0, nextIdle=0000000011FD4370, requestAfterThread=2, _tpfd=000000001203F560writeCorkCount=1, terminateCallback=0000000000000000, ioError=No error, lastError=No error, terminateError=Connection closed by peer giveCmd @000000001401BA78: _queuedOn=0000000000000000, ran=N, wantWake=N, wantFailIfLoopDone=N, cmd=2, ok=Y, chan=000000001203F560 writeDataAvail @000000001401BAB0: _queuedOn=0000000000000000, ran=N, wantWake=N, wantFailIfLoopDone=N, chan=000000001203F560 wbuf: ptr=000000001401BB18, size=0x8000, rptr=0x0, wptr=0x8000 x86 CPUID registers: 0: 0000000A 756E6547 6C65746E 49656E69 1: 000006FB 09040800 0004E3BD BFEBFBFF 2: 05B0B101 005657F0 00000000 2CB43048 3: 00000000 00000000 00000000 00000000 4: 0C000121 01C0003F 0000003F 00000001 5: 00000040 00000040 00000003 00002220 6: 00000001 00000002 00000001 00000000 7: 00000000 00000000 00000000 00000000 8: 00000400 00000000 00000000 00000000 9: 00000000 00000000 00000000 00000000 A: 07280202 00000000 00000000 00000503 80000000: 80000008 00000000 00000000 00000000 80000001: 00000000 00000000 00000001 20100800 80000002: 65746E49 2952286C 6F655820 2952286E 80000003: 55504320 20202020 20202020 45202020 80000004: 30333337 20402020 30342E32 007A4847 80000005: 00000000 00000000 00000000 00000000 80000006: 00000000 00000000 0C007040 00000000 80000007: 00000000 00000000 00000000 00000000 80000008: 00003028 00000000 00000000 00000000 terminating... Splunk crashes, a restart gets it working for a while, then it crashes again. Any ideas what I need to do in order to correct this?

ShaneNewman · ‎11-26-2013

I am having an issue with an indexer, this is the information from the logs: Any help would be greatly appreciated. 11-26-2013 14:08:09.796 -0600 WARN PropertiesMap - Cannot convert string "flase" into bool for "SHOULD_LINEMERGE" 11-26-2013 14:08:12.031 -0600 ERROR AdminManager - Stack trace from python handler:\nTraceback (most recent call last):\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\n hand.execute(info)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "C:\Program Files\Splunk\etc\system\bin\DataModelAccelerationHandler.py", line 20, in handleList\n sc_rest.BaseRestHandler.handleList(self, confInfo)\n File "C:\Program Files\Splunk\etc\system\bin\sc_rest.py", line 74, in handleList\n ent = self.all()\n File "C:\Program Files\Splunk\etc\system\bin\sc_rest.py", line 221, in all\n offset=self.posOffset)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 129, in getEntities\n atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 222, in _getEntitiesAtomFeed\n serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\rest\__init__.py", line 461, in simpleRequest\n serverResponse, serverContent = h.request(uri, method, headers=headers, body=payload)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1421, in request\n (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1171, in _request\n (response, content) = self._conn_request(conn, request_uri, method, body, headers)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1147, in _conn_request\n response = conn.getresponse()\n File "C:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 1033, in getresponse\n raise ResponseNotReady()\nResponseNotReady\n 11-26-2013 14:08:12.031 -0600 ERROR AdminManager - Unexpected error "<class 'httplib.ResponseNotReady'>" from python handler: "". See splunkd.log for more details. 11-26-2013 14:08:12.031 -0600 ERROR SummarizationHandler - Error listing accelerated data models: Unexpected error "<class 'httplib.ResponseNotReady'>" from python handler: "". See splunkd.log for more details. 11-26-2013 14:08:12.140 -0600 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=rejected 11-26-2013 14:08:24.140 -0600 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=rejected 11-26-2013 14:08:36.140 -0600 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=rejected 11-26-2013 14:08:39.406 -0600 INFO databasePartitionPolicy - idx=os_aix Creating hot bucket=hot_v1_30, given event timestamped=1385496510 11-26-2013 14:08:39.406 -0600 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\os_aix\db'. Reason='Bucket directory structure changed.' 11-26-2013 14:08:44.515 -0600 INFO KeyManagerSearchPeers - Reading public key for peer: C:\Program Files\Splunk\etc\auth\distServerKeys\NADCWPAPPSPL01\trusted.pem 11-26-2013 14:08:44.515 -0600 INFO KeyManagerSearchPeers - Finished reading public key for peer: C:\Program Files\Splunk\etc\auth\distServerKeys\NADCWPAPPSPL01\trusted.pem 11-26-2013 14:08:44.968 -0600 ERROR AdminManager - Stack trace from python handler:\nTraceback (most recent call last):\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\n hand.execute(info)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "C:\Program Files\Splunk\etc\system\bin\DataModelAccelerationHandler.py", line 20, in handleList\n sc_rest.BaseRestHandler.handleList(self, confInfo)\n File "C:\Program Files\Splunk\etc\system\bin\sc_rest.py", line 74, in handleList\n ent = self.all()\n File "C:\Program Files\Splunk\etc\system\bin\sc_rest.py", line 221, in all\n offset=self.posOffset)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 129, in getEntities\n atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 222, in _getEntitiesAtomFeed\n serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\rest\__init__.py", line 461, in simpleRequest\n serverResponse, serverContent = h.request(uri, method, headers=headers, body=payload)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1421, in request\n (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1171, in _request\n (response, content) = self._conn_request(conn, request_uri, method, body, headers)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1147, in _conn_request\n response = conn.getresponse()\n File "C:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 1033, in getresponse\n raise ResponseNotReady()\nResponseNotReady\n 11-26-2013 14:08:44.968 -0600 ERROR AdminManager - Unexpected error "<class 'httplib.ResponseNotReady'>" from python handler: "". See splunkd.log for more details. 11-26-2013 14:08:44.968 -0600 ERROR SummarizationHandler - Error listing accelerated data models: Unexpected error "<class 'httplib.ResponseNotReady'>" from python handler: "". See splunkd.log for more details. 11-26-2013 14:08:48.140 -0600 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=rejected 11-26-2013 14:09:00.140 -0600 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=rejected 11-26-2013 14:09:00.359 -0600 WARN PubSubConnection - Cannot convert str: to a valid status, returning eRejected. 11-26-2013 14:09:04.125 -0600 ERROR AdminManager - Stack trace from python handler:\nTraceback (most recent call last):\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\n hand.execute(info)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "C:\Program Files\Splunk\etc\system\bin\DataModelAccelerationHandler.py", line 20, in handleList\n sc_rest.BaseRestHandler.handleList(self, confInfo)\n File "C:\Program Files\Splunk\etc\system\bin\sc_rest.py", line 74, in handleList\n ent = self.all()\n File "C:\Program Files\Splunk\etc\system\bin\sc_rest.py", line 221, in all\n offset=self.posOffset)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 129, in getEntities\n atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\entity.py", line 222, in _getEntitiesAtomFeed\n serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\rest\__init__.py", line 461, in simpleRequest\n serverResponse, serverContent = h.request(uri, method, headers=headers, body=payload)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1421, in request\n (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1171, in _request\n (response, content) = self._conn_request(conn, request_uri, method, body, headers)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1147, in _conn_request\n response = conn.getresponse()\n File "C:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 1033, in getresponse\n raise ResponseNotReady()\nResponseNotReady\n 11-26-2013 14:09:04.125 -0600 ERROR AdminManager - Unexpected error "<class 'httplib.ResponseNotReady'>" from python handler: "". See splunkd.log for more details. 11-26-2013 14:09:04.125 -0600 ERROR SummarizationHandler - Error listing accelerated data models: Unexpected error "<class 'httplib.ResponseNotReady'>" from python handler: "". See splunkd.log for more details. 11-26-2013 14:09:12.140 -0600 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=rejected 11-26-2013 14:09:24.140 -0600 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=rejected

ShaneNewman · ‎11-26-2013

11-25-2013 17:32:14.981 -0600 ERROR Application - Application=SA-ModularInput-PowerShell cannot be loaded, as path=C:\Program Files\Splunk\etc\deployment-apps\SA-ModularInput-PowerShell does not exist. 11-25-2013 17:32:14.981 -0600 ERROR DSManager - Failed to reload serverclass=MSSQL: Application=SA-ModularInput-PowerShell cannot be loaded, as path=C:\Program Files\Splunk\etc\deployment-apps\SA-ModularInput-PowerShell does not exist. 11-25-2013 17:32:14.981 -0600 WARN TenantService - Did not reload DSManager: Application=SA-ModularInput-PowerShell cannot be loaded, as path=C:\Program Files\Splunk\etc\deployment-apps\SA-ModularInput-PowerShell does not exist. 11-25-2013 17:32:14.981 -0600 ERROR loader - Deployment Server is not available, because errors prevented its initialization: 'Application=SA-ModularInput-PowerShell cannot be loaded, as path=C:\Program Files\Splunk\etc\deployment-apps\SA-ModularInput-PowerShell does not exist.'. You can try to reload Deployment Server after correcting the errors. 11-25-2013 17:32:14.981 -0600 INFO loader - win-service: Windows service is now in running state.

ShaneNewman · ‎11-24-2013

I found the issue after getting into the searchpeers folder. Turns out that we had someone from their desktop connecting to the indexer pool and sending a bundle about 600MB every 5 minutes.

ShaneNewman · ‎11-22-2013

Were you able to get this working?

ShaneNewman · ‎11-22-2013

What I have show above mimics index and forward, it is just less cumbersome and makes it easier to change. Changes using this method also do not require a restart of the instance either, just a reload of the EAI Objects.

ShaneNewman · ‎11-20-2013

Perhaps look into the SearchSelectLister module.

Posts	310
Solutions	35
Karma Given	339
Karma Received	86
Member Since	‎07-25-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

S3 bucket with CSV files not extracting fields at ...

Panels in Splunk App for Jenkins not loading

Connect Splunk DB Connect to MariaDB with SSL and ...

Capabilities needed for a service account to enabl...

How do I add a dynamic _meta field pushed from dep...

Help with hot buckets rolling prematurely

Color map not working on New Relic Splunk App

Monitoring of Java Virtual Machines with JMX: Why ...

Splunk Synthetic Transaction not working

Create table with nested columns

Re: Files not being Indexed

Re: Any good experience with Splunk consultants?

Files not being Indexed

Re: Running report from large amount of data

Re: Splunk indexers crashing

Re: Running report from large amount of data

Re: CSV imports, headers as fields?

Re: IIS log file data duplication - "Checksum for ...

Splunk Prerelease 6.0.0.2 and WS2003

Re: IIS log file data duplication - "Checksum for ...

Re: The lookup table '...' does not exist

Re: cannot create a report or dashboard from a SQL...

Re: transforms filter

Re: Deleted events still showing in search summary

Re: transforms filter

Re: User Permission to use dblookup

Re: FAILED_LOAD_DEPLOYMENT_SERVER__TENANT_default

Re: Failures after Upgrading to 6.0

Failures after Upgrading to 6.0

FAILED_LOAD_DEPLOYMENT_SERVER__TENANT_default

Re: FAILED_LOAD_DEPLOYMENT_SERVER__TENANT_default ...

Re: Bundle Replication Issue

Re: Configuration for Splunk for Excel Export ap

Re: How can I purposely duplicate events to multip...

Re: Pulldown Switcher

Join the Conversation