You actually can delete data from indexes, but by default, nobody (not even admin) has this permission. You would have to give a user the "can delete" capability, only then will you be able to use the "delete" search command. It acts on events which are streamed to it, so you can be very granular by creating a search which outputs only what you want deleted, then add "| delete" and hit enter. ... View more

Can you be more specific? What cloud? What object storage system? The details matter. ... View more

Try a search for "eventtype=ucs-inv BD_SPLUNK". We want that to return zero results. Also, inspecting the above, it looks like there is some truncation. Was that a paste error, or is that how it looks? You are seeing one of two problems which I am aware some are seeing. Hopefully we can figure out which one. What Splunk version? UCS Manager version? ... View more

No, it should not take long for data to show up. Have a look at the below, and if you've got some helpful error messages, let us know. This is all from the README in the main app root folder: TEST YOUR INSTALL The main app dashboard can take some time before the data is returned which will populate some of the panels. A good test to see that you are receiving all of the data we expect is to run this search after several minutes: index="cisco_ucs*" | stats count by sourcetype In particular, you should see these sourcetypes: * ciscoucs:ucsm:fault * ciscoucs:ucsm:inventory * ciscoucs:ucsm:perf If you have configured UCS to send syslog events into Splunk, you may also see: * ciscoucs:syslog * syslog If you don't see these sourcetypes, have a look at the messages output by the scripted input: Collect.py. Here is a sample search that will show them: index=_internal component="ExecProcessor" Collect.py | table _time host log_level message (INFO log_level is good, WARN or ERROR are bad.) ... View more

I wasn't aware that this ever worked, but I am not an expert in the deployment specifics of these apps (but I do know VMware & NetApp tech fairly well). ... View more

I can't speak for the team, but this is probably one of those "to ship is to choose" things. If you like, you can open a support case to make a feature request that this current state be changed. ... View more

Just as a sanity check, do you know how to retrieve the same counters via CLI or NetApp's system manager? If so, can you verify that the data is present there? Update your original post with the results if you can do so. ... View more

@derekking, sounds like your best bet here is to create a whole new question, citing this error message at the top. Nobody will find you down here in a comment to an old and answered question, except for the guy who posted the question, the one who posted the answer to which you replied, plus anyone who followed it, like me. Much more visibility to make a new Q, especially since you've actually got a new problem. ... View more

Any reason you are using System.Collections.Generic.Dictionary[[String],[String]]? I've not tried this before, but the first thing I'd do is to see if a regular array works. The problem is likely related to the magic array unrolling that PowerShell likes to do, bit I'm not certain. ... View more

I just edited the Answer above and added "from Linux/Unix", which makes @jrodman's above comment more explicit. I had someone ask me about this one today and this was not clear. Also, I just started a chat with the docs team who will be revising the linked pages and making everything clean. As jrod says--native works. Unix can index to (insert caveats here) or roll cold to NFS, and Windows can do the same to SMB. But neither OS can hop across to the other protocol. These things could be made to work, but as nobody seems to want to do so, it's not been tested, so the current state is as described. Hope that makes sense. ... View more

You could probably do this with the Azure file service which exposes an SMB share. Performance...may not be great, or even good. That would need to be vetted out thoroughly. I would be hesitant and don't recommend this approach as a best practice. ... View more

I'm not seeing that this answer is relevant to the question. @charris_splunk, you want to revise the answer a bit? ... View more

@mikaelbje afraid that's not possible, UCS does not support alternate ports! But they could differentiate the events in another way. For example, send all UCS events to a unique IP endpoint, distinct from others. The IP could simply be an additional address for the very same host, but that unique IP would show up in the event somewhere and could be used as a search filter. Or, use a syslog server and a heavy forwarder, etc, etc. Lots of ways. Source: UCS docs ... View more

This is a challenge with any app which overrides fields that another app relies on. There are ways around it. Luckily, there’s actually not a ton of reliance on syslog events in the current UCS app. What I recommend in the short term is to go into the Splunk_KB_CiscoUCS app. Make a local/ folder if you haven’t already. Open default/eventtypes.conf and copy the first three stanzas out to local/eventtypes.conf: [ucs-syslog] search = index=cisco_ucs sourcetype="ciscoucs:syslog" description = Cisco UCS events received via syslog [ucs-syslog-event] search = index=cisco_ucs sourcetype="ciscoucs:syslog" mnemonic="EVENT" description = Cisco UCS events received via syslog [ucs-syslog-audit] search = index=cisco_ucs sourcetype="ciscoucs:syslog" mnemonic="AUDIT" description = Cisco UCS events received via syslog And in each search line above, alter it to match what you need it to be to account for the IOS app’s overriding. I suggest perhaps a combination of sourcetype and host fields. Don’t forget that you can use macros here as well. So you could add a new macro, say call it cisco_ucs_manager_manager_hosts . Then your search lines might look like: search= sourcetype=cisco:ios ` cisco_ucs_manager_manager_hosts` I ship some macros in the main dashboard app, so you may want to put your macros there--but they can be stored anywhere that's in context for the users of the app. But for example, in SplunkAppForCiscoUCS/local/macros.conf: [cisco_ucs_manager_manager_hosts] definition = host=ucsmanager* Or, definition = host=host1 OR host=host2 OR host=host3 Obviously, you’ll need to edit the lines to suit your environment. ... View more

Yes, it should be fine. If it isn't, we will address that ASAP. We have a few engineers who are very knowledgeable about PowerShell around here. Let me know if you find otherwise, and I'll ask the lab as well just to be sure. Now operating system or product versions could be a different matter. @halr9000 on Twitter ... View more

Got it. Like this: ... View more

Can you provide an example of the nav menu XML that exhibits the above behavior? ... View more

Looks like disabling is good enough workaround for you. However, it'd be really nice to have some closure on the cause of mongod not wanting to die. Did you look at index=_internal to try and find the cause? ... View more

I think you want the Monitor Files and Directories section of the Getting Data In manual. How you access a file, whether it's local or remote, is a matter of your operating system, and architectural preference. You might also want to look at deploying a forwarder (on that remote target). ... View more

Deprecation is a frequent point of confusion. If something is deprecated, it's still supported, and the feature in question is still going to be around for (at least) 2 more major versions. That could easily be a couple of years, or longer. Deprecation is a great planning tool. ... View more

I think this is the right root cause--something to do with the PowerShell modinput. That error message is saying that splunkd doesn't know what to do with the powershell lines. I suspect that the modular input is not installed correctly. On the same machine which is running the TA-DomainController-2012R2 app (your DC, presumably), be sure that the PowerShell modinput is also in the etc/apps folder. Double-check permissions? You could also try running (at an elevated prompt): splunk.exe btool check --debug ... View more