Did you ever manage resolve this? ... View more

We have tried that. It allows to install apps through a web interface but it doesn't allow to upload the app files or to manage the apps, namely disable/enable them. I have played around with configurations, in particular I have found out that if a role is imported like the following: importRoles = admin or user, or power role, even if you disable the capabilities afterwards, these are overridden. For example, with the configuration above, even if the following is inserted in the authorize.conf file, it isn't applied. license_tab = disabled license_edit = disabled Anyone with similar problem or solution? ... View more

So I got my cluster working. I noticed that while using splunk documentation. When inititating search head peers etc, the doc provides https examples. Since I knew I wasn't using SSL I inputed http for all of my initating and config files. Splunk however uses its own certificates and that's why you should use https for all of your URI's. I also used regular IP numbers as instead of domain names. Thanks. ... View more

bump. We applied this fix ages ago but still seems to be an issue today. ... View more

hi may i know how you split the data . what configuration changes did you make in syslog daemon please respond .. ... View more

Even I have same issue. Heavy forwarders are not forwarding _internal logs ... View more

Okay this is good news, it answers my question as well except now I'm left wondering how it works. The remote performance monitoring data input requires that an index be specified. When a heavy forwarder is doing the collecting does this index imply the one at the actual index server or the one on the heavy forwarder? If it's going on the heavy forwarder index AND being forwarded, how do I clear out the local index so it's not building up a big index like the one on my receiver/indexer? I can rig a forwarder and have the same machine do remote performance monitoring. Is that all there is to it or do I need to configure something else so it's working the way I expect, ie collecting data at the forwarder then sending the data to the indexer for storage? ... View more

Thank you for your answer. Nevertheless, have you actually tested it? And yes you are true, the DS doesn't push apps, just waits for queries from UFs. I wasn't very successful keeping the question simple! ... View more

persistentQueuePath is not used in Splunk 4.2.x Only the persistentQueueSize can be changed. The location is hardcoded to $SPLUNK_HOME/splunk/var/run/splunk/??pin/pq_ eg TCP:2012 = /opt/splunk4/splunk/var/run/splunk/tcppin/pq_2012 UDP:2012 = /opt/splunk4/splunk/var/run/splunk/udpin/pq_2012 Hope this helps ... View more

I'm just wondering if this still is a working solution, as the official documentation states it won't work. From the documentation at http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Usepersistentqueues: Persistent queues are available for these input types: TCP UDP FIFO Scripted inputs Windows Event Log inputs Persistent queues are not available for these input types: Monitor Batch File system change monitor splunktcp (input from Splunk forwarders) I have a scenario where I'd like to put intermediate forwarders (also acting as deployment servers) in different security zones to limit the traffic flow between zones. In an event where the indexers go down I need to have the intermediate forwarder buffer data from universal forwarders on disk. We have an additional complication too, and that is the one of useACK=true. Obviously an acknowledgement from the indexer cannot be sent if it's down, and it's not the intermediate forwarder's job to acknowledge, so it sounds like a catch-22 to me. Is the only option to increase the buffers or persistentQueueSize on the universal forwarders and let them handle all the buffering? My scenario is in a way similar to the one in http://answers.splunk.com/answers/78388/splunk-store-and-forward-ha.html ... View more

Without specifications, the FORMAT goes directly to the _raw field. But if you are using it to modify a metadata field (host, source, index, etc....) then you have to use the format source::mysource (for a static source) or in the case or a dynamic regex match REGEX=blahblah(mymatch)blahblah FORMAT=myfield::$1 the $1 $2, etc will be the different matches in the Regex. ... View more

Hi rgill90, only saw your message today. I have one example as follows: Inputs.conf [splunktcp://:9997] connection_host = ip _TCP_ROUTING = splunkssl Outputs.conf [tcpout] defaultGroup = splunkssl [tcpout:splunkssl] compressed = true server = :9997 sslCertPath = ... sslPassword = ... sslRootCAPath = ... sslVerifyServerCert = true As you can see, the attribute value at inputs.conf of _TCP_ROUTING is splunkssl and at the outputs you must have that same name at tcpout. Naturally you can give any name you want (no need to be "splunkssl" but they must match in both files) ... View more

Fernando, http://docs.splunk.com/Documentation/Splunk/latest/Security/Securingyourdeploymentserverandclients ... View more

comment about scalability of the deployment-server http://splunk-base.splunk.com/answers/12384/hardware-requirements-for-deployment-server-in-large-deployment ... View more

Can you please guide how you assigned the permissions to log file. I used chmod to assign the read permissions but it is not working. When the file get rolled over the permissions were not carried so forwarder stops sending the data. ... View more

1) Yes, leave everything as specified in inputs.conf. Essentially the index you specify becomes the default index. In fact, you could simply make one props.conf and transforms.conf entry to override the index from the second host if you like. 2) That changes the the index that the input writes to at index time. 3) Format is the format for how to write to the field. You're overriding the index in the transform. Format can be used with regexes as well (see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf), but since we're not we can just specify the index name. ... View more

Hi , I am trying to nullify the windows event log which are of "type=Information" and i want only the events having errors and warnings. i am not able to achieve kindly help . I am using below: props.conf [WinEventLog:Application] TRANSFORMS-set= setnull transforms.conf [setnull] REGEX = "Type=Information" DEST_KEY = queue FORMAT = nullQueue ... View more

Yes, you can use Windows TA or simply in the UF inputs.conf, configure the whitelist or blacklist. The whitelist or blacklist functionality exists only from UF v6 onwards. The original post was in 2012, probably at that time, the solution was to do the regex on the indexer or heavy forwarder layer. ... View more