Hi everyone,   I'm currently having a difficulty installing a UF in one of our Microsoft Server 2019 that is residing as VM via Hyper-V. Please do take note that this is a fresh installation of universal forwarder in this machine. Also, this server is acting as a domain controller and we would like to get its logs.   Kindly show me the way since I have been searching for hours and could not find a proper answer for this. Also, I would like to avoid doing a reformatting on this specific machine just to install the UF. Thank you.   This shows the logs:   12:23:30 AM C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Program Files\SplunkUniversalForwarder\bin\splunkdrv.inf >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" 12:23:34 AM C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Program Files\SplunkUniversalForwarder\bin\splknetdrv.inf >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" 12:23:37 AM C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Program Files\SplunkUniversalForwarder\bin\SplunkMonitorNoHandleDrv.inf >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" 12:23:40 AM C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" This appears to be your first time running this version of Splunk. 12:23:40 AM C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" The certificate generation script did not generate the expected certificate file:C:\Program Files\SplunkUniversalForwarder\etc\auth\server.pem. Splunkd port communication will not work. SSL certificate generation failed. Creating: C:\Program Files\SplunkUniversalForwarder\var\lib\splunk Creating: C:\Program Files\SplunkUniversalForwarder\var\run\splunk Creating: C:\Program Files\SplunkUniversalForwarder\var\run\splunk\appserver\i18n Creating: C:\Program Files\SplunkUniversalForwarder\var\run\splunk\appserver\modules\static\css Creating: C:\Program Files\SplunkUniversalForwarder\var\run\splunk\upload Creating: C:\Program Files\SplunkUniversalForwarder\var\run\splunk\search_telemetry Creating: C:\Program Files\SplunkUniversalForwarder\var\spool\splunk Creating: C:\Program Files\SplunkUniversalForwarder\var\spool\dirmoncache Creating: C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\authDb Creating: C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\hashDb 12:23:45 AM C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\SplunkUniversalForwarder\bin\SplunkMonitorNoHandleDrv.inf >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" 12:23:47 AM C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\SplunkUniversalForwarder\bin\splknetdrv.inf >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" 12:23:49 AM C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\SplunkUniversalForwarder\bin\splunkdrv.inf >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"     ... View more

Hi everyone, Screenshot of issue:           Here are my setup with my current issue: I'm running this search in a clustered environment I'm running Splunk 8.0.5 Using search command in CLI Running search command to display results of savedsearch  Attached below is the search command in CLI I used: /opt/splunk/bin/splunk search "|savedsearch TestReport" -maxout 0 -auth test:test   Additionally, below is the content of such savedsearch: index=myindex(sourcetype=sourcetype1 OR sourcetype=sourcetype2) _index_earliest="01/17/2020:22:00:00" _index_latest="01/17/2020:22:59:00" | stats count   I need the search result of CLI to display once since I'm using its content to populate another csv which I will use for another purpose.   Kindly let me know if there is something that I need to reconfigure in my environment. Thank you!   Regards, Raj ... View more

Aside from using 'export' result, is there a way on doing a 'one shot archiving' of the indexer cluster using archiving policy of Splunk? If there is one, what are the recommended steps on doing so. Thank you.     Regards, Raj ... View more

Hi,   I have asked this question since we have forwarders that, for some reason, will not be able to upgrade to Win10 or OS that accomodates 7.x onwards.   Is it possible to receive the events, possibly a csv file, from 6.x going through 7.x to 8.x IDX? If yes, what are the possible implications from it?   Thank you. ... View more

Hi, The screenshot presented below shows that there are 2 pairs that negates each other which should equal to 0 on column1, same with column2. With that in mind, the total value should be 0, right? But upon rounding it up to 13th decimal value and beyond, it no longer equates to 0.       I've attached a search query that will replicate the said issue stated above.       | makeresults | eval column1=600.0000 | append [| makeresults | eval column1=390.0000] | append [| makeresults | eval column1=355.0000] | append [| makeresults | eval column1=575.0000] | append [| makeresults | eval column1=355.0000] | append [| makeresults | eval column1=590.0000] | append [| makeresults | eval column1=600.0000] | append [| makeresults | eval column1=355.0000] | append [| makeresults | eval column1=-600.0000] | append [| makeresults | eval column1=-590.0000] | append [| makeresults | eval column1=-355.0000] | append [| makeresults | eval column1=-575.0000] | append [| makeresults | eval column1=-355.0000] | append [| makeresults | eval column1=-390.0000] | append [| makeresults | eval column1=-600.0000] | append [| makeresults | eval column1=-355.0000] | eval column2=round(column1/1.12,20) , column1=round(column1,20) | addcoltotals     Thank you.   Regards, Raj ... View more

Hello everyone, I tried using 'UseACK' with batch monitoring. It seems that it is okay to use when the system is usually experiencing network issues. However, once the system reboots(hard), the data stored in-memory is lost. I read that persistentQueue stores the data in disk instead of memory but the said option does not support batch monitoring. Is there a way to retain the data even after a reboot using batch monitoring? Thank you. Regards, Raj ... View more

Let's say I've already specified my filters and submitted my search with "sort" command in it. My search sorts the results according to date but then I decided to sort the table by amount field by clicking the header. Then I changed my search's date filter to another date and clicked submit. Please take note that my search has "sort" command in it, why does my table still sort according to amount? Do I need a JS to handle this? I wish the result would sort according to date but it seems the previous sort(amount) supersedes the sorting of my search. Please enlighten me on this one. Thank you. Regards, Raj ... View more

Good day! I'm wondering why the ODBC driver can't connect to the search heads via ELB. If I only use the SHs' address, the driver works but if I use the ELB address, the driver fails. Please enlighten me with this. Thank you! Btw, the error that the driver gives me when it fails is: (40) HTTP API : Couldn't connect to server ... View more

Good day, sirs! What system resource do I need to increase to increase the speed of parsing of my Heavy Forwarder? My instance uses 'batch' monitoring to monitor 21 folders for ingestion but it seems it can't keep up because the files are getting piled in their respective folders waiting for their turn to be parsed and ingested. The process would be: CRON that extracts the file from archives and send to 21 folders(different sourcetypes) -> heavy forwarder monitor those folders -> parse -> send to the indexer. Please enlighten me. Thank you! Regards, Raj ... View more

Good day! Can you please enlighten me about what system resource does each instance mostly use ? Indexer: Dedicated Search Heads: CM: Deployer: Deployment: Ex: Indexer: Throughput Reliant(Disk), DSH: CPU Cores Something like that. Thank you! Regards, Raj ... View more

Good day! Is there any possible way to export a statistic table with over 50 fields? We're trying to imitate a report that they do manually, it's just that when exporting the table as PDF, the table gets cut off and it continues to the next page. I'm thinking of exporting it as an excel but are there any good way or practice to do it? Thank you and have a nice day! Regards, Raj ... View more

I tried ingesting it using add oneshot then midway through it, splunk suddenly stops. Aside from splitting the file, is there a way to ingest this file without splunk stopping suddenly? Can splunk monitor three 200gb+ files at the same time? Thank you. Regards, Raj ... View more

It's been going on for days now and I don't know where to investigate. It says in the /var/log/messages that it cannot allocate memory. The remedy I used for this is to reboot the instance, but then as soon as the splunk starts it crashes again.. I mean the whole system hangs. Please help. I've already disabled the THP and adjusted the ulimits. ... View more