We had the same issue but after a few minutes those messages cleared without any action on our part. ... View more

You are using the Cisco ESA CIM compliant app correct? https://splunkbase.splunk.com/app/1761/ Are you having issues even though you are using the app? ... View more

Yes, just make sure you have permissions for the user running Splunk to your /var/log/ log directory and that you configure the Splunk_TA_nix inputs.conf [monitor:///var/log] enabled (This can be done via the GUI under the Apps menu Apps->Splunk add-on for Nix http://www.function1.com/2015/07/splunking-the-linux-audit-system ... View more

Are they parsed correctly meaning you see the expected fields? Next thing to try will be to look at the dashboard panel, move your mouse to the left bottom, an icon should appear to allow you to run the search. Take a look at that search to determine where the issue is. If the icon is not there then look at the job inspector to find the search it is running to fill the panel. ... View more

Where are you trying to create the new input? ... View more

so if you search with just sourcetype=pan:log you get events? and those events have the expected fields? ... View more

Please confirm that your sourcetypes are correct. They should start with pan: See: http://pansplunk.readthedocs.io/en/latest/getting_started.html#step-3-create-the-splunk-data-input Also check to see if you have the your role "Indexes to search by default" with the paloalto index selected. ... View more

The answer is to use a token in your panel search that points to your dropdown. This is very easy to do. Please see http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/tokens ... View more

I have done this a couple of different ways in the inputs.conf file within the local directory of the db connect app. input_timestamp_column_name = RecordTime input_timestamp_format= to let Splunk handle the conversion automatically also input_timestamp_column_name = WHENGMT input_timestamp_format=yyyyMMddHHmmss I always have output_timestamp_format = yyyy-MM-dd HH:mm:ss It takes some trial an error to get certain data sets to work. I suggest sending the events (records) to a test index that you can delete. Then set the tail_rising_column_checkpoint_value back to 0 to re-import the events. Use the 'All Time' search so you can see future event timestamps in case you have the GMT offset wrong. ... View more

I duplicate your example and then changed the IP's and customer names. The below regex works unless your events change format. I ran a test with your example data as sometimes the rex does not work the same as regex101.com You highlighted "abc" as the customer name. The Splunk auto extract of the field=value pair does not properly work with your data as demonstrated with the below search index=main | rex "START\:\s(?((\d{1,3}\.){3}\d{1,3}))\s.*?customer_name\=(?[a-zA-Z\d\s:]+)" | table _time customer_name cust_name ipaddr ... View more

Check this to see if it helps. At least it answers yes to time based kvstore lookups https://answers.splunk.com/answers/209693/time-based-lookups-and-kvstore.html ... View more

First your search command is fine. Setting can_delete will allow you to delete. (Make sure you remove can_delete when you are done.) Anything is possible with permissions but it is likely good if you are indexing data into the index We do not have write/read permissions in our roles, splunkd writes, you read, unless you set can_delete. The roles can restrict the index you are allowed to use but you said your search returns events so you are good there. Are your indexers clustered? See this section in the link below: "The delete operation and indexer clusters" http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/RemovedatafromSplunk As already mentioned, check splunkd.log for errors ... View more

On Linux try netcat to confirm your connection is open or telnet 52.33.140.2 10001 Also your collectd.conf does not look like it is in the XML format shown in the readme collectd.conf: Host "127.0.0.1" # log to the localhost Port "5000" Protocol "tcp" ... View more