I have some zip files that I need to reindex after cleaning the target index and refining the props. I cannot get splunk to re-ingest them no matter what--even after cleaning the fishbucket. Here is the TailingProcessor state for one of them: <s:key name="/opt/splunkdata/tmp/cm/2014.11/2014001.zip"> <s:dict> <s:key name="file position">0</s:key> <s:key name="file size">10239974</s:key> <s:key name="parent">/opt/splunkdata/tmp/cm/2014.11</s:key> <s:key name="percent">0.00</s:key> <s:key name="type">finished reading</s:key> </s:dict> </s:key> While percent is 0, it has finished reading it. As far as I can tell from other Answers, this is not supposed to happen. Btprobe is no help: splunk cmd btprobe -d /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db --file /opt/splunkdata/tmp/cm/2014.11/2014001.zip Using logging configuration at /opt/splunk/etc/log-cmdline.cfg. record not found So can't reset it that way. Then I took the radical step of cleaning the fishbucket..still no joy. I can't see any way around this; and furthermore it looks like some kind of bug--oneshots aren't working either. Anyone know a solution? Version is 6.4.2 Thanks! ... View more

I'm having a weird problem with the AWS app that I simply can't figure out. I am seeing different numbers of instances reported by sourcetype=aws:config and sourcetype=aws:description. I would have thought they would be the same but they're not. After filtering for running state, not deleted and so on, aws:description is showing me 100 running instances at the present moment--which the AWS admins tell me is correct--but aws:config has only 89 collected over all time. I do not see how this is even possible. And the dropdown in 'Individual EC2 Instance' only shows around 40. I've checked in the AWS console and the config dashboard there is also showing the correct number--100. Somehow Splunk is throwing away 11 instances, but I can't see where or how. Plainly the SNS/SQS plumbing is working or I wouldn't be seeing any config items at all. Has anyone seen this before? ... View more

Since there's no link to do this... Setup: Automatically detect the available network interfaces, and add a dialogue for which one/s to capture on. Configure streamconf.xml. Set the app's default index to something other than 'main'. This default is not sensible. Add some way to bulk change streams to use another index. Changing them one by one is painful. Alternatively, automatically create index 'stream' and use that by default. Dashboard panels: The webinar I attended suggested this search: index=stream |iplocation dest_ip prefix=sip_ allfields=true | geostats longfield=sip_lon latfield=sip_lat count Why not just add it to the App? ... View more

It's all in the question 🙂 The app is otherwise up and running quite happily, but all_account_ids.csv did not get created and every input that uses it shows 'Search produced no results'. This is fine as long as I have only one account active, but soon I'll have more. It seems to me that aws_account_manager.py is supposed to create it, but doesn't. Anyone seen this problem before, and what can I do about it? Manually create with Lookup Editor, or some other way? Thanks! ... View more

This is a cosmetic question and may apply to the native mapping feature in general. The map for this panel always opens centered on the USA, which is extremely irritating if you're not from there. How do you change the default center starting location of the map? ... View more

More of a comment for the developers since I've solved it. The saved search Config: Topology Data Generator does not seem to get run at any point unless you do it manually, and until you do the Topology view doesn't populate. Does this step perhaps need to be included in the setup documentation, or is it supposed to run automatically somehow? There's no schedule for it so I don't see how, and tt isn't called by the dashboard as far as I can tell. ... View more

The app is only partially working: Change overview dashboard: Apps: detected that I removed a test app but not that I installed it. I tried a second one: detected that I installed it, but not that I removed it. Users: detected that I created a user Roles: detected that I created a role Indexes: did not detect a new index. However it DID show up in change investigation. This is the only inconsistency I found between these two dashboards. You have not used the macro in the Overview dashboard, it's hardwired to _audit. This is easily fixed; I did so. Saved searches: detected the deletion of the searches in the first test app (though not their installation as noted above) but not any other modifications or additions to saved searches of which I've made several. Macros: detected changes I had to modify ct_fields_savedsearches to remove action.email.subject and action.email.to because they don't exist in the base search for saved searches, and aren't filled in by evals. Hence any stats command relying on them won't return any results. I modified ct_report_period to -7d@ latest=now because I kept getting N/A in the top panel which I didn't like. Eventtypes: detected new eventtype I haven't modified any props, transforms or server classes. Can anyone assist with getting this going properly? I'm running it on a stand-alone dev laptop and I've set the indexer and sh count to 1 and patterns to the hostname of the machine. Since some of the content is showing up correctly, the thing is obviously working somewhat. Not sure where to go next. Also, not sure about the wisdom of sticking yet more stuff in _audit. I made a new index config_tracker. ... View more

I wasn't able to get Incident Setting to display any alerts after setting the script to alert_handler.py, and had a look at the search. What you're doing is this: | rest /servicesNS/nobody/$app$/saved/searches/.. [snip] Why not do this instead? Gets you out of having to worry about app context and owner altogether... not all alerts are owned by 'nobody'. For instance, in SA-nix, they're owned by admin (on my installation anyway) | rest /servicesNS/-/-/saved/searches/ ... [snip] Just a thought cmeo ... View more