Great! responsys_cm solved my problem too. Actually, I found out that somewhat there was another app with a "manager directory" under /default/ui/ directory. I removed that directory, restarted and also the duplicate entries disappeared. Marco ... View more

that answer doesn't apply. In that case there was a duplicate Search app. I've the same problem, but no copy of a search app. ... View more

Remigio, the "problem" is fields definition. Fields in Splunk can either discoveder automatically by Splunk by default on a syntax like "string=value", or you can simply define them using regex. Field extractions are based on the "sourcetype", that is the "kind" of log data you're analyzing. Pre defined sourcetype, like WinEventLog:* rely on english default language to recognize fields. So, you should enhance this by defining new fields extraction for the WinEventLog:* sourcetypes using the string in Italian. More about defining fields extractions can be found here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Managesearch-timefieldextractions Regards, Marco Scal ... View more

Luke, thanks for this clarification, but how this "identities_expanded.csv" is build? Why an account not present in "identities.csv" the appears as "default account" in "identities_expanded.csv"? Moreover, is there a way to "reset" it? Thanks, Marco ... View more

I think that babyd was interested in suggestions and best practise to adopt planning a migration from ES 2.x to ES3. We're also interested: some customer with ES 2.4 are asking for migration pros and cons and we need more accurate infos to plan the migration and estimate possible costs and efforts. Thanks! Marco Scala ... View more

Same error running the following command: ./btprobe -d /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/ --file /opt/splunk/var/log/ /opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.1: cannot open shared object file: No such file or directory uname -a: Linux 2.6.32-220.17.1.el6.x86_64 #1 SMP Thu Apr 26 13:37:13 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux ... View more

David, you forgot the "train" command after train.py: "$SPLUNK_HOME/bin/python train.py train "root_set_dir" "Model_name" it really needs "train" again! Marco ... View more

Hi! just trained my own set!!! Move into the "$SPLUNK_HOME/etc/apps/sentiment/bin" directory type "$SPLUNK_HOME/bin/python train.py train "root_set_dir" "Model_name" where "root_set_dir" is the name ofthe first segment of the dir you created under "sentiment/training_data" containing the train subdir with the sample data. if you have: /opt/splunk/etc/apps/sentiment/training_data/my_model/train you have to run the following command: "$SPLUNK_HOME/bin/python train.py train my_model/ my_model Marco Scala ... View more

I deleted the old "twitter2" app, reinstalled and the the setup worked. ... View more

I'm trying to make it work on Splunk 6.0.1: could this be my problem? ... View more

almost same error here: Error while posting to url=/servicesNS/nobody/twitter2/admin/passwords/%3Amarco_scala%3A (where "marco_scala" is my twitter account... I suspect in my case is a previous installation that created this entry... ... View more

I'm sorry to contraddict your reply: in the Splunk for PCI app, for instance, everytime there's a host, src or dest field, the automatic lookups are fired to produce more infos from the assets.csv file. So the cost of in my case has always a quite significant value. The search "sourcetype=vanguard" in the last 15m has the following costs: 1.959 events in 8,65 seconds. 5,021 command.search 4,049 command.search.lookups ... View more

I've found this transfom in "unix" app that sets a fixed value field based on a specific regex: [userdel] REGEX = .*?((?:remove|delete) (?:user|group|account)) .(\w+). FORMAT = action::delete name::$1 user::$2 where the value of field " action " is set to " delete ". So, in a similar way also my example should work. Marco ... View more

no way to converto those "string" into values?!? ... View more

Sorry, but why shouldn't be effective from a performance point of view? The REGEX is simple and matches immediately? And this solution was reported also on Splunk doc (http://docs.splunk.com/Documentation/Splunk/5.0.6/Admin/Transformsconf) with this example of search time extraction: FORMAT = first::$1 second::$2 third::other-value BUT, to be honest, I was also trying to make it work and I didn't, and had to use a lookup-based solution similar to your suggestion. Marco PS: BTW, why didn't it work?! ... View more

This answer abore modifies the _raw data adding unwanted stuff not originally present. The right solution is in between: the transforms should be just something like transforms.conf: [metrics] REGEX = . FORMAT = abc::xyz that's it. Marco ... View more

Snare si fine, but I do recommend, whenever is possible, to use a Universal Forwarder on the Windows servers to send logs to Splunk indexers, because you can take advantage of Forwarder's functionality like load balancing, consistency of logs sent in case of communication failures or in the indexer is down, just to mention some. Moreover, using a forwarder, you have native recognition of events coming from WinEventlog. ... View more

I had a different error message, but the solution was the same: Operation "ospath_fopen" failed in /opt/splunk/p4/splunk/branches/5.0.2/src/libzero/conf-mutator-locking.c:254, conf_mutator_lock(); Permission denied Operation "ospath_fopen" failed in /opt/splunk/p4/splunk/branches/5.0.2/src/libzero/conf-mutator-locking.c:319, conf_mutator_unlock(); Permission denied ... View more

I installed it on our test/training server, with not much data (I have to admin), but I haven't seen those heavey CPU Usage. We have CentOS VM with 4 virtual Core. ... View more

Those are the errors I got instead: (Splunk 4.3.4 running on Mac OSX 10.7.4): 09-22-2012 11:42:06.218 +0200 WARN SetupAdminHandler - Cannot find entity='' 09-22-2012 11:42:06.218 +0200 WARN SetupAdminHandler - Cannot find field='name' in url='/admin/passwords/_new/' setting value to empty string 09-22-2012 11:42:08.997 +0200 INFO ExecProcessor - Ran script: python /usr/local/splunk/etc/apps/twitter/bin/splunk_twitter_streamer.py, took 265.2 milliseconds to run, 0 bytes read, exited with code 1 09-22-2012 11:42:08.997 +0200 ERROR ExecProcessor - message from "python /usr/local/splunk/etc/apps/twitter/bin/splunk_twitter_streamer.py" Could not get Twitter credential s from splunk. Error: No credentials supplied, please complete the Twitter app setup 09-22-2012 11:42:14.983 +0200 WARN SetupAdminHandler - Cannot find entity='' 09-22-2012 11:42:14.983 +0200 WARN SetupAdminHandler - Cannot find field='name' in url='/admin/passwords/_new/' setting value to empty string 09-22-2012 11:42:15.014 +0200 WARN SetupAdminHandler - Cannot find entity='' 09-22-2012 11:42:15.015 +0200 WARN SetupAdminHandler - Cannot find field='name' in url='/admin/passwords/_new/' setting value to empty string 09-22-2012 11:42:15.094 +0200 INFO ExecProcessor - New scheduled exec process: python /usr/local/splunk/etc/apps/twitter/bin/splunk_twitter_streamer.py 09-22-2012 11:42:15.094 +0200 INFO ExecProcessor - interval: 30000 ms 09-22-2012 11:42:15.116 +0200 WARN SetupAdminHandler - Cannot find entity='' 09-22-2012 11:42:15.116 +0200 WARN SetupAdminHandler - Cannot find field='name' in url='/admin/passwords/_new/' setting value to empty string 09-22-2012 11:42:32.850 +0200 WARN SetupAdminHandler - Cannot find entity='' 09-22-2012 11:42:32.851 +0200 WARN SetupAdminHandler - Cannot find field='name' in url='/admin/passwords/_new/' setting value to empty string 09-22-2012 11:42:32.882 +0200 WARN SetupAdminHandler - Cannot find entity='' 09-22-2012 11:42:32.882 +0200 WARN SetupAdminHandler - Cannot find field='name' in url='/admin/passwords/_new/' setting value to empty string 09-22-2012 11:42:38.997 +0200 INFO ExecProcessor - Ran script: python /usr/local/splunk/etc/apps/twitter/bin/splunk_twitter_streamer.py, took 265.4 milliseconds to run, 0 bytes read, exited with code 1 09-22-2012 11:42:38.998 +0200 ERROR ExecProcessor - message from "python /usr/local/splunk/etc/apps/twitter/bin/splunk_twitter_streamer.py" Could not get Twitter credential s from splunk. Error: No credentials supplied, please complete the Twitter app setup ... View more