I'm using splunk 6.1.3 with a deployment server. I distribute indexes.conf to my indexers via an indexer serverclass. When the deployment client receives the updated indexes.conf, the client creates the new directory ... ie: /indexes/test/colddb and /indexes/test/db The problem though, is that while the owner of those directories is the right user (splunk), the group affinity is always root, and that index is not writeable until I manually change it to the default group that splunk is associated with. This is a NIS+ environment and I'm wondering if that's causing me a problem. I have added the splunk user to /etc/passwd and the associated group to the /etc/group file ... but the problem still persists. total 16 drwx------ 4 splunk root 4096 Aug 26 19:23 . drwxr-xr-x 7 splunk service 4096 Aug 26 19:23 .. drwx------ 2 splunk root 4096 Aug 26 19:23 colddb drwx------ 3 splunk root 4096 Aug 26 19:23 db Is there an issue with Splunk being able to operate in a NIS+ environment? Thank you. ... View more

I've noticed in another Splunk environment at my site that they've set up what appear to be undocumented stanzas in props.conf [foo:BAR] REPORT-fooregex0=fooregex0 assume that foo is the sourcetype and BAR is a pattern in an event logged in the 'foo' sourcetype. In the props.conf spec and example, and in numerous web searches I have failed to find a reference to this stanza type ... Can someone give me some insight or point to some documentation on it? Thanks very much. ... View more

This may be a long winded question ... After upgrading one of our search head pools from 4.3.6 to Splunk 6.0 I'm finding that I'm having to make XML changes to many of the forms that worked fine in 4.3.6 ... This could be due to my having written poorly formatted code in the earlier version, or it could be due to a change in functionality ... example: ... the block contains this ... |inputlookup oradb.csv | table host,SID,RAC_INSTANCE,LIFECYCLE | where (host LIKE "$s_hostname$") AND (SID LIKE "$s_instance$") The XML that applies to this template looked like this: </fieldset> <input type="text" token="s_hostname"> <label>Enter a hostname or pattern</label> <default></default> <suffix>%</suffix> </input> </fieldset> <fieldset> <input type="text" token="s_instance"> <label>DB Instance Name</label> <default></default> <suffix>%</suffix> </input> </fieldset> Now in order to get this to work ... I had to make the following changes: {code} </fieldset> <input type="text" token="s_hostname"> <label>Enter a hostname or pattern</label> <! I had to add the '%' in the default block ... which worked without it in 4.3.6 --> <default>%</default> <suffix>%</suffix> </input> <! I removed the end and beginning fieldset blocks --> <input type="text" token="s_instance"> <label>DB Instance Name</label> <! I had to add the '%' in the default block ... which worked without it in 4.3.6 --> <default>%</default> <suffix>%</suffix> </input> </fieldset> Also ... in Splunk 6, the default values are visible in the input boxes of the form ... I assume that is now expected behavior ... If anyone has a better suggestion for formatting this XML ... I'd welcome it. ... View more

We have our search heads pooled in batches of 4. I installed Google Maps into the shared application directory and have restarted all search heads, but I'm encountering an error when trying to use the geoip command. Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'geoip' Should I be installing this app on all of our indexers? Should I install it on our deployment server and then have one of our serverClasses handle getting it to our search heads and/or indexers? I see this error referenced in quite a few places on SplunkBase, but I'm not really finding a similar situation to compare ours to. Thank you. ... View more