I am trying to configure eStreamer add-on. I see the following errors in the log ERROR IOError: \nTraceback (most recent call last):\n File "./estreamer/service.py", line 180, in main\n self.start( reprocessPkcs12 = args.pkcs12 )\n File "./estreamer/service.py", line 140, in start\n pidFile.create()\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pidfile.py", line 40, in create\n with open( self.filepath, 'w' ) as pidFile:\nIOError: [Errno 2] No such file or directory: '/opt/splunk/etc/apps/TA-eStreamer/bin/encore/https:/x.x.x.x-8302_proc.pid'\n The scripts and directories inputs are all enabled. Index is properly configured and also the connectivity works fine. Any recommendations will be really helpful. ... View more

Am trying to solve a problem here. The inputs.conf for one of the monitoring stanza on the forwarder had index = main . I changed the inputs.conf on Deployment server and defined index = a and enabled restart splunkd. Am able to see an updated inputs.conf with index = a under the monitoring stanza. However, when I do a btool, I still see index = main for the same monitoring stanza. How do I send data to index = a instead of index = main? Any help will be appreciated. Thanks. ... View more

I am trying to connect to a SQL Express Instance that is running on the MSSQL server. Tried using the edit URL option in order to explicitly mention the instance name. However it still causes issues and throws an error "Connection failed for user : user" Is it necessary to have jtds driver instead of jdbc driver for the connection to SQL Express instance? Thanks, Akshay. ... View more

I have installed the Splunk_TA_microsoft-sqlserver and the logs are showing the following error : 04-22-2019 09:10:58.180 -0500 ERROR TailingProcessor - Skipping stanza 'monitor://C:\Program Files\Microsoft SQL Server\MSSQL*\MSSQL\Log\SQLAGENT.OUT' due to error: Failed to regex-split wildcarded path: C:\Program Files\Microsoft SQL Server\MSSQL*\MSSQL\Log\SQLAGENT.OUT for stanza monitor://C:\Program Files\Microsoft SQL Server\MSSQL*\MSSQL\Log\SQLAGENT.OUT.. Is this a MSSQL error or Splunk is not liking the way the input stanza is configure? Any insights will be appreciated. Thanks, Akshay ... View more

I am running Citrix Netscaler Add-on for Splunk and the splunkd.log shows following errors: t_uri, method, body, headers, redirections, cachekey) File "D:\Splunk\etc\apps\Splunk_TA_citrix-netscaler\bin\Splunk_TA_citrix_netscaler\ta_util2\httplib2_init.py", line 1335, in _request (response, content) = self._conn_request(conn, request_uri, method, body, headers) File "D:\Splunk\etc\apps\Splunk_TA_citrix-netscaler\bin\Splunk_TA_citrix_netscaler\ta_util2\httplib2__init_.py", line 1291, in _conn_request response = conn.getresponse() File "D:\Splunk\Python-2.7\Lib\httplib.py", line 1121, in getresponse response.begin() File "D:\Splunk\Python-2.7\Lib\httplib.py", line 438, in begin version, status, reason = self._read_status() File "D:\Splunk\Python-2.7\Lib\httplib.py", line 394, in _read_status line = self.fp.readline(_MAXLINE + 1) File "D:\Splunk\Python-2.7\Lib\socket.py", line 480, in readline data = self._sock.recv(self._rbufsize) error: [Errno 10053] An established connection was aborted by the software in your host machine I tried checking if it was related to Windows permissions issue related to execution of scripts, but it is not. Am I missing something? ... View more

I have the assets and identities list configured using LDAP search. Is there an option to automatically update the assets and identities lookups without running that LDAP search? Any insights will be appreciated. Thanks ... View more

We are implementing the Splunk PCI app and the indexer is supposed to be in PCI app and report to the PCI app. However, in the PCI asset logging report we see that the indexer is not reporting. Any insights on the problem? Thanks. ... View more

I am trying to get the windows events logs on Windows hosts by installing a forwarder and Splunk_TA_windows on windows machines. Do I need to install the the TA on the indexer which is a Linux host? Will the linux host be able to collect data? Any help will be appreciated. Thank you. ... View more

I am trying to stop the splunkd.log and metrics.log from Windows Universal Forwarders. Since it is a distributed environment, I deployed a small base app config to make this happen. My inputs.conf stanza looks like as follows: [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log] index = _internal disabled = true [monitor://$SPLUNK_HOME\var\log\splunk\metrics.log] index = _internal disabled = true Any suggestions? Thanks in advance. Akshay ... View more

I am trying to configure Splunk ES app. Need to know what exactly Identity_Management data model means. Any thoughts? Thanks. ... View more

SA-LDAP How I am trying to get the Active Directory data using Splunk Supporting Add-on for Active Directory. I tried the following search |ldaptestconnection domain=abc.com" and the events pop-up in the list. However, when I try using the example search to get in data, I get the following error: Any insights on this issue will be appreciated Thanks. ... View more

Are all the asset lookup fields mentioned in the asset lookup file compulsory fields? ... View more

I have an asset list in PCI Compliance app and should_timesync is set to true in that list. Is there a way to validate if those 3 servers which are there in asset list are actually time syncing or not? I am basically expecting those servers to be populated when I run the time synchronization report. Thanks. Akshay ... View more