Following the upgrade from 6.1.1 to 6.1.3, we found that mounted bundles were having issues (configured using http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuremountedbundles). Our search head and indexers could not communicate to each other, with log entries like the following: Search head: 08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - Unable to upload bundle to peer named splunk-indexerserver with uri=blah:8089. 08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - bundle size=1141MB, path=/opt/splunk/var/run/splunk-searchheadserver-1408027681.bundle, is too large for replication, max_size=1024MB. Check for any large unwanted files in $SPLUNK_HOME/etc/ Indexer: 08-14-2014 14:33:26.499 +0000 ERROR LMTracker - failed to send rows, reason='Unable to connect to remote peer: splunk-searchheadserver:8089 rc=2' [will add answer separately] ... View more

I am trying to setup Splunk DB Connect to an Oracle database that has a service name but no SID. I can't get past the verification because I keep getting this error ... Encountered the following error while trying to update: In handler 'dbx-databases': Error connecting to database: java.sql.SQLException: Listener refused the connection with the following error: ORA-12514, TNS:listener does not currently know of service requested in connect descriptor This happens whether I try to use the service name or the database name in the "Database/SID" field. I have no issues connecting to the database using other clients. Is there another setting somewhere that is missing to use the database name or service name? Here is the format for the tnsnames.ora entry that I use on other clients ... NAME_SN = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = some.hostname1.com)(PORT = 1521)) (ADDRESS = (PROTOCOL = TCP)(HOST = some.hostname2.com)(PORT = 1521)) (FAILOVER = yes) (LOAD_BALANCE = no) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = NAME_SN) ) ) ... View more

I have https configured with splunk web running on port 443, and everything works fine when I type in https://splunkweb.com. I am trying to configure httpd to run on port 80 and have an auto-redirect script automatically redirect requests for http://splunkweb.com to https://splunkweb.com. However it seems that there is something blocking me from using port 80, because if I hit http://splunkweb.com I get a message that says "the server unexpectedly dropped the connection". If I configure httpd to use any other port, like 800 for example, the redirect works fine (http://splunkweb.com:800 -> https://splunkweb.com), it just doesn't like port 80. I have verified in netstat that nothing else is using port 80 but httpd, so I don't think there is a port conflict. I also don't have iptables running. Before I setup https in splunk web it was using port 80 just fine, so I don't think there was any firewall rules blocking it. Any ideas as to why this isn't working? I am wondering if there is a cherrypy configuration somewhere that needs to be changed? ... View more