Here are two more relevant apps: Splunk App for Microsoft SQL Server Splunk DB Connect ... View more

What version of Splunk? If using the admin user account, have you changed the password from the default? If not, try changing the password, as I think I recall a policy that restricts certain REST endpoints when the default password is present. Are you using the default self-signed SSL cert, or have you installed your own "real" one? PowerShell doesn't like self-signed certs, this could be related to your problem, although I would expect the error message to say so, e.g.: Invoke-HTTPPost : Exception calling "GetRequestStream" with "0" argument(s): "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel." Also try looking at the exception details. Here's an example of mine, but I'm not able to repro your issue. PS C:\Users\Hal> $error[0] | Format-List * -Force writeErrorStream : True PSMessageDetails : Exception : Microsoft.PowerShell.Commands.WriteErrorException: Exception calling "GetRequestStream" with "0" argument(s): "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel." TargetObject : CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-HTTPPost ErrorDetails : InvocationInfo : System.Management.Automation.InvocationInfo ScriptStackTrace : at Invoke-HTTPPost, C:\Users\Hal\SkyDrive\PowerShell\Modules\Splunk\Splunk-Core\Splunk-Core.psm1: line 280 at Invoke-SplunkAPIRequest, C:\Users\Hal\SkyDrive\PowerShell\Modules\Splunk\Splunk-Core\Splunk-Core.psm1: line 599 at Get-SplunkAuthToken, C:\Users\Hal\SkyDrive\PowerShell\Modules\Splunk\Splunk-Authentication\S plunk-Authentication.psm1: line 334 at Connect-Splunk, C:\Users\Hal\SkyDrive\PowerShell\Modules\Splunk\Splunk-Authentication\Splunk -Authentication.psm1: line 127 at <ScriptBlock>, <No file>: line 1 PipelineIterationInfo : {0, 1} ... View more

Does your Splunk install use the default ports, or not? Where does 5617 come from? Default is 8000 for humans, and 8089 for REST API. Modify your question to add this detail please. ... View more

Agreed with Rich, since this is very specific to PowerShell, not Splunk. But I'll give you a hint real quick. You need to look at two areas: filtering, and working with objects generally. You can use a variety of methods to filter input. One is the Where-Object cmdlet. But when working with PowerShell, it's best to convert text strings into objects, as it's much easier to work with them that way. This script that I found real quick (I googled for "powershell query rdc") shows a technique to use the qwinsta.exe command, but then converting the output to CSV, and then using the ConvertFrom-CSV to turn it into objects. HTH ... View more

I'd post this to serverfault, TechNet forums, /r/powershell, or the like. That said... ... View more

I wrote a blog post on this topic: http://blogs.splunk.com/2013/07/26/getting-data-from-collectd-into-splunk/ ... View more

Glad that worked out. What led you to that solution? I think some more detail in this answer would be helpful to others who may come after you with the same issue. TIA ... View more

Can you try this on RHEL or CentOS? Those are the only supported platforms for a DCN according to the docs (http://docs.splunk.com/Documentation/NetApp/latest/DeployNetapp/Platformandhardwarerequirements#Splunk_data_collection_node_resource_requirements). If it's still broken there, then open a support case so that we can get your diag logs. ... View more

Sorry, no more time to poke around. Must be a different Windows and/or Firefox version. I suggest finding some firefox-specific resources, then come back here for how to use what you learned in Splunk. ... View more

Ahh, bummer! The Addon also requires PS 3.0, so that won't work. Maybe stop by #powershell on FreeNode or Powershell.org forums sometime to chat about making that upgrade happen. ... View more

First step is to figure out how to do this from the command-line. Looks like the extensions/addons are defined in a JSON file in the user's default profile. The JSON is easy to parse in PowerShell (or Splunk). Second step is to be sure that the Splunk Addon for Microsoft PowerShell is on all your forwarders. That makes it much easier to invoke PowerShell statements or scripts from inputs.conf. Here is part of your solution: $defaultProfilePath = "$env:appdata\mozilla\firefox\profiles\*.default\" # only one should end in "default" $addonFile = Join-Path -Path $defaultProfilePath -ChildPath "addons.json" # Read files from JSON and convert to PowerShell objects # You should put these inside try/catch to handle file not found and output intelligent error to Splunk $a = Get-Content $addonFile | ConvertFrom-Json # Write a timestamp (Windows doesn't specify timezone unless you force it, so let's be unambiguous and convert to UTC) Write-Output (get-date).ToUniversalTime().ToString("u") # List Addon data $a.addons | Format-Table name,type,version,id I just wrote output using Format-Table, which can then be parsed in Splunk using multikv. It would be much simpler at search time in Splunk if you instead use key-value pairs. That's easily done in PowerShell, just make a Foreach-Object loop and build your string in there. Note that plug-ins (binary code) are not in this list, they are in a file called pluginreg.dat. That file is a bit harder to parse, but certainly doable. HTH ... View more

Can you give some search command examples which work and don't? ... View more

I'll ask for a follow up. ... View more

They triage bugs once a week. But the process thereafter can take some time. May want to think about workarounds for now. ... View more

I just opened a defect. Will update here once it has been triaged. ... View more

I'm trying to see if this is a Splunk bug, which is what I suspect. There are some others who have hit the same error message, e.g. http://answers.splunk.com/answers/113095/error-in-pivotprocessor-unable-to-fetch-datamodelreport-rest-endpoint ... View more

Smooth. 🙂 ... View more

I suggest not sending duplicate data in the first place. Instead, consider putting a syslog server in place that can listen on UDP and buffer events to disk. Then install a Splunk forwarder on that system to relay the events to Splunk over TCP / HTTPS. A forwarder can be configured to intelligently send events out to multiple index servers simultaneously. This is important, because the more indexers that can participate in a distributed search, the faster your search will complete. And the forwarder gracefully handles failure scenarios automatically. If one indexer goes down, it will continue sending events to the others. If the network goes down, it will buffer events and send when it comes back up, and so on. Another solution would be to use a load balancer, but as pointed out in this answer, it's impossible for a load balancer to know if a UDP service is listening. ... View more

Are you sending data to two UFs as a high availability requirement? If so, you may want to change the title and tags a bit to get more visibility. This isn't a Cisco question, it's a "how do I do HA for syslog inputs" question, if I'm reading you right. Or, how do I de-dupe data question, perhaps. ... View more