hi, Chrome is my browser. I found where the problem came from. My browser is in french language so in my URL, I have a part "fr-FR" and the app work only in "en-us". So, when I change it it works. Thanks ... View more

ok thank you I will try to re-install it. ... View more

Hi, Yes a have. Is it possible that I have this problem because my splunk instance is on a windows OS ? ... View more

Hi, I'm using windows for infrastructure v1.1.2 on splunk v6.2 ... View more

04-30-2014 09:39:50.594 +0200 ERROR SearchParser - Missing a search command before '''. ... View more

I've got these warn too : 4-29-2014 07:09:03.287 +0200 WARN DatabaseDirectoryManager - Failed getting size of path='/opt/splunk/var/lib/splunk/_internaldb/db/hot_v1_25/1398748141-1398748141-17881382023628152521.pre-tsidx': No such file or directory 04-29-2014 20:12:54.237 +0200 WARN DateParserVerbose - A possible timestamp match (Wed Apr 16 22:50:02 2008) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://userRxData|host::10.1.1.250|logsnmp_userRxData|139711641420800 ... View more

I'm using this search string : "index=snmp source="snmp://useraplocation" | join ipaddress [search index=snmp source="snmp://username"] | join ipaddress [search index=snmp source="snmp://userrole"] | dedup ipaddress | table _time, ipaddress, username, borne, ssid" on a real-time 30 second window. 2) Indeed I've got this error : 04-28-2014 16:36:53.268 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" No SNMP response received before timeout snmp_stanza:snmp://userRxData snmp_destination:10.1.1.250 snmp_port:161 ... View more

In my firm, I have 13 access point wich cover all stage. People can connect on it and I want to have statistics about it. That is why I'm using this App. My access points are Aruba's. So to try my mibs, I downloaded a mibbrowser. When I use it I can see all clients for example I have got 3 devices connected on 2 differents network. When I execute a snmp request with the mib browser, I can see all of them. But when I do it with the snmp app i can see only one. here my inputs.conf : [snmp://UserName] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.1.2.1.1.3.0 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_username split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 0 [snmp://UserRole] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.4.0 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_userrole split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 0 [snmp://UserUpTime] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.5.0 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_useruptime split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 0 [snmp://UserApLocation] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.10 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_useraplocation split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 0 [snmp://DeviceType] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.39.0 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_devicetype split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 0 [snmp://user_snr] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.1.2.2.1.7 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_user_snr split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 1 [snmp://userRxData] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.42.0 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_userRxData split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 0 [snmp://ApActive] communitystring = public destination = 10.1.1.250 do_bulk_get = 1 index = snmp ipv6 = 0 mib_names = ARUBA-MIB object_names = .1.3.6.1.4.1.14823.2.2.1.1.3.1.0 port = 161 snmp_mode = attributes snmp_version = 2C snmpinterval = 30 sourcetype = logsnmp_apactive split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 1 ... View more

Thank you a lot ... View more

Thank you when I add a filter I have my data. But I always see in the main page LAST EVENT : 8 days ago ? I don't know why ... View more

Ok so I can see that I have events in my indexer. But when I try to catch out them with a simple "*" I don't have anything ... View more

how can I see what's going wrong with SoS ? I can see a lot of things but for example I can't see anything in "Warnings and errors" ... View more

I have the ERROR : tcpinputproc : could not bind to port IPV4 port 80 do you know what is it ? ... View more

I installed SoS app but how can it help me ? I don't see anything wrong at this time. But I can see some errors in my logs ... View more

I am running a linux platform "centOs 6" I just used "*" as search string in last 24 hours. On the start page of my own apps I can see 2,527,605 Events INDEXED and LATEST EVENT : 7 days ago. In my splunkd.log I have some errors notified many times splunkd.log : 03-26-2014 13:07:38.038 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" No SNMP response received before timeout snmp_stanza:snmp://snmp_user_ssid snmp_destination:10.1.1.250 snmp_port:161 03-27-2014 11:06:14.625 +0100 WARN ExecProcessor - Streaming XML data: Received an event with missing or empty "data" tag. 03-27-2014 12:09:41.981 +0100 ERROR databasePartitionPolicy - insufficient privileges to perform this operation 03-27-2014 12:09:42.588 +0100 ERROR StreamingDeleteOperator - Error in 'delete' command: You have insufficient privileges to delete events. 04-09-2014 23:23:11.925 +0200 WARN DateParserVerbose - A possible timestamp match (Tue May 10 10:20:57 2005) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://userRxData|host::10.1.1.250|logsnmp_userRxData|0 And for my licence all details are correct (I'm french) Thank you for your help ... View more