Looking at the "provenance" field in the search i found that only fields containing the value "UI:Search" were related to actual search queries. The rest like dashboard searches that fire off automatically appear under other field values.   Hope that helps ... View more

Can anybody me with the commands to specifically opening firewall ports foe an on-premise installation? Also, what ports to open and how to open the ports? ... View more

Yes, @strive can you please tell me why you have used license_usage.log and license_usage.log* , I know it does make a difference but can you please explain why you used it differently specifically in this case ?  Also can someone please tell the difference between type=RolloverSummary and type=Usage along with addressing @strive 's initial query.  Thank you so much. ... View more

Hi, While it is true that there is no direct support for 2FA (Duo) in Splunk Cloud anymore (it was removed after 6.6 I believe), the way to still achieve 2FA is to do it at the SAML/IDP layer. As long as your IDP supports 2FA and the 2FA bits happen outside of Splunk, go for it. ... View more

I believe you are right as per; https://answers.splunk.com/answers/636862/error-usermanagerpro-usersystem-had-no-roles.html ... View more

The official Splunk support stance as of 2018-04-30 is that Docker is NOT supported. If you would like to see official support of docker in the future, please talk to your account team and upvote the following enhancement request; PBL-11109 ... View more

There's a document that describes how to recover from this: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Resolveorphanedsearches However, I could neither "Temporarily recreate the invalid owner" (we use LDAP), nor "Perform a knowledge object stanza copy and paste operation between two .conf files" (the search is on a SHC). No guidance exists for this situation. I can remove the files from the SHC, but other documentation says "changes made to configuration files on SHCs will not be replicated". To remove them, I edited all my searchhead $SPLUNK_HOME/etc/users//.../savedsearches.conf files directly on each member of the cluster to change "enableSched" to "0", then initiated a rolling-restart of my SHC. This worked for me. ... View more

Now that I turned that off, I don't get the fields for the Nix search. I suspect that's because change the permissions to app only kills the field extractions. ... View more

For which version of SplunkJS this hack should be applied? ... View more

| rest /servicesNS/-/-/saved/searches splunk_server=local As per: https://answers.splunk.com/answers/231694/how-can-i-get-a-list-of-all-saved-searches-from-al.html Also: https://answers.splunk.com/answers/12488/how-to-list-saved-searches.html ... View more

Common Answers seem to be: https://answers.splunk.com/answers/337702/splunk-db-connect-2-why-am-i-getting-error-cannot.html ⎝ Increase max connections. https://answers.splunk.com/answers/488736/why-does-splunk-dbconnect-execute-query-transactio.html ⎝ useConnectionPool = false https://answers.splunk.com/answers/475392/splunk-db-connect-how-to-resolve-dbxquery-error-fa.html ⎝ upgrade to 2.4.0 ⎝ maxWaitMillis = 60000 ... View more

<?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Unauthorized</msg> </messages> </response> ... View more

Please note though that if you select a range on the time range picker and double click it, Hunk will launch a new query using that time range. ... View more

Wouldnt it be better to hold the logfiles as long as the Searchhead has not all results? This way we are missing the remote-Search.log from the indexer everytime the indexers have a high difference in finishing their Search. ... View more

Not enough info really. It could be a few things, for example; As per: https://answers.splunk.com/answers/67327/splunk-java-sdk-connection-to-splunk-failed.html And: https://answers.splunk.com/answers/206990/why-am-i-getting-a-splunk-java-sdk-handshake-failu.html "Ensure that your connection credentials are correct, notably that you are using HTTPS over Port 8089 to your SplunkD Server. As a guess, you might be trying to connect to SplunkWeb on port 8000, which is not where the REST endpoints are located." As per: https://answers.splunk.com/answers/209379/no-appropriate-protocol-protocol-is-disabled-or-ci.html "Splunk needs to release a new jar without SSLv3 hardwired (in HttpService.java) in order to make this work with the latest Java 8. Meanwhile you need to stick with Java 7 or build your own jar from the SDK package and use SSLv2 instead." ... View more

Hi, The original issue occurred with a completely default install of the forwarder, so no custom configurations. I haven't checked it since, but noticed that several bugs were fixed with btool in version 6.4.6. So this issue may be resolved with a newer version. 2017-01-26 SPL-119992, SPL-130547, SPL-130548 btool returns incorrect output for inputs.conf with certain modular and scripted input combinations ... View more

thanks for adding the solution! ... View more

So I got my cluster working. I noticed that while using splunk documentation. When inititating search head peers etc, the doc provides https examples. Since I knew I wasn't using SSL I inputed http for all of my initating and config files. Splunk however uses its own certificates and that's why you should use https for all of your URI's. I also used regular IP numbers as instead of domain names. Thanks. ... View more