Can you post the search you used? ... View more

You could also download the .tar /.gz file directly from splunkbase.com and extract it to $SPLUNK_HOME/etc/apps then restart Splunk. ... View more

Just a shot in the dark but did you set the pass4symkey in the server.conf on all required instances? http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Enableclustersindetail#Configure_the_security_key If that's not it I hope the rest of that doc may be of some use to you. ... View more

Here's the documentation for SEDCMD in props.conf https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Anonymizedata#Define_the_sed_script_in_props.conf ... View more

@jip31 Did you have a look at the Splunk Add-on for Windows? http://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows https://splunkbase.splunk.com/app/742/ Let me know if this helps. ... View more

@mgrant74 Did you install the dependencies? https://splunkbase.splunk.com/app/3693/#/details under the "Details" tab "Dependencies: Splunk Security Essentials for Fraud Detection depends on the following apps Splunk Machine Learning Toolkit Python for Scientific Computing Clustered Single Value Map Visualization 3D Scatterplot All above apps can be downloaded for free from Splunkbase. When installing these apps please select the appropriate platform. Make sure these apps are properly installed in your Splunk environment before installing this app." Also, did you follow the Quick Installation Suggestions? "Quick Installation Suggestions Due to very large size of the app - it may be a challenge to install it via normal, GUI way. Here are suggested steps to install this app in a faster, more reliable manner: - Download the app to your computer - Unzip it manually (via WinRar or 7Zip or related linux utilities) - If you do not need Healthcare demo - you may delete Healthcare dataset - all files under ./Splunk-SE-Fraud-Detection/DATA/af-cms* - this will greatly reduce the size of the app as well. - Move ./Splunk-SE-Fraud-Detection tree under ./etc/apps of your Splunk installation - Restart Splunk - If you included (did not delete) healthcare datasets - give app some time (30-60 minutes) to index the complete datasets. Once indexing is finished (af-cms-* indexes stopped growing) - the app is ready for use" Let me know if this helps. ... View more

Just wanted to add this link describing THP's impact on memory to woodcock's answer. http://docs.splunk.com/Documentation/Splunk/7.1.1/ReleaseNotes/SplunkandTHP Hope this helps. ... View more

@jriley in addition to this you can try to start the service from Powershell. If you launch powershell as an admin and then cd in to your install directory... ex: cd C:\Program Files\Splunk\bin and then... .\splunk start that should get your splunk service running. Let me know if that helped. ... View more

Please see the link below. https://answers.splunk.com/answers/834/how-to-reset-the-admin-password.html ... View more

You're very welcome! ... View more

I would raise a support case and submit the diag along with any information you have that might allow support to reproduce/troubleshoot the error. This is definitely the type of thing they're there for. I wish I could be of more help. Before submitting your case, be sure that you are listed as a contact on the company support entitlement. If you are not listed, have the person who is the designated support contact at your company submit the case. ... View more

Do your permissions for Splunk and all of its folders and subfolders (including all the apps) on the two servers in question match the rest of the currently working servers? ... View more

You're very welcome! ... View more

I don't see mistake yet but here are the docs I'm referencing. Hope this helps. https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#Event_Log_whitelist_and_blacklist_formats ... View more

It could be a file-precedence issue. Is this inputs.conf in the local folder of the app? ... View more

harishalipaka's comment above should work if you add it to the end of your search. For more info on the fields command please see the docs at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fields ... View more

In order to remove events at index time use SEDCMD in props.conf ex: [your_custom_sourcetype] SEDCMD-remove = s/(place_regex_that_matches_events_you_wish_to_remove_here)//g Let me know if that helps. ... View more

Does this post resolve your issue? https://answers.splunk.com/answers/60056/dashboard-permissions.html ... View more

Does this answer your question? https://answers.splunk.com/answers/355874/how-to-find-license-usage-by-indexes.html Please let us know. ... View more

Using your sample event I was able to ingest the data with the proper timestamp using the following props.conf [test_sourcetype] SHOULD_LINEMERGE = true TIME_PREFIX = startedTime:\s TIME_FORMAT = %s%3N LINE_BREAKER = \}([\r\n]+) BREAK_ONLY_BEFORE_DATE = false MAX_TIMESTAMP_LOOKAHEAD = 300 TRUNCATE = 1000 Keep in mind that this was done with only a single event so your MAX_TIMESTAMP_LOOKAHEAD and TRUNCATE values may have to be adjusted as necessary. Please let me know if this helped. ... View more

Are you able to show us your current props.conf? Is it just the timestamp that you're having trouble with? ... View more