I use the following commands on my light forwarders to add an index and set new files to use it. /opt/splunkforwarder/bin/splunk add index java /opt/splunkforwarder/bin/splunk add monitor -index java When using the universal forwarder I get this error: # /opt/splunkforwarder/bin/splunk add index java The object "index" is not supported on this installation. What is the proper way to assign files to a specific index when using the universal forwarder? ... View more

Is there a way to make trendline project moving averages into the future? ... View more

I get this error which I suspect is from reading in a file whith no timestamps in it? Error in 'IndexScopedSearch': The search failed. More than 125000 events found at time 1293916026. 1) Is there an easy way to see which file caused the error 2) Is there a was to force Splunk to spread the file across multiple timestamps? ... View more

I get a NoneType is not iterable while piping to geoip on version 4.1.5, build 85165. I am able to run the same command on another search head running 4.1.2 and do not get this error. Does anyone know what might be causing it? Search: source="*access_log*" | geoip clientip Error: External search command 'geoip' returned error code 1. Script output = "Traceback (most recent call last): File "/opt/splunk/bin/runScript.py", line 69, in execfile(REAL_SCRIPT_NAME) File "/opt/splunk/etc/apps/maps/bin/geoip.py", line 115, in if not ip_field in headers: TypeError: argument of type 'NoneType' is not iterable " ... View more