I am having a heck of a time understanding NET-SNMP configuration and am hoping that has successful done this for windows can assist me. Please do not post links to NET-SNMP tutorials etc as I have been through ALL of them and I am still having issues. Really all I need to figure out is how change the port on the NET-SNMP and NET-SNMPtrap service to use ports 1161 and 1162. I have tried snmpconf -i and did not have much luck. ... View more

I am running Splunk 5.0.1, am in a Windows workgroup enviornment, and have 2 Windows 2008R2 servers as indexers for redundancy (indexerA and B). What I am looking to do is to establish a process to, should one server go down, restore the index from the second server. Let's say indexer B goes down for a week and I am ready to bring it back up online this is the process that I would execute... Indexer A - roll the hot dbs to warm by running the folling command: $SPLUNK_HOME\Splunk _internal cal /data/indexes/main/roll-hot-buckets -auth admin: disable splunkd on indexerA log onto indexer B and map network drive to on indexer A copy defaultdb from indexer A to indexer B restart splunk on both instances and both indexes should now have the same exact data Does this sound correct? ... View more

Running Splunk 5.0.1 on windows 2008R2. I had to move my index to another server...followed the steps perfectly...rolled hot to warm....copied $SPLUNK_home...\defaltdb to same location on new server...started splunk. All looks good but for example on the summary page HostA has 6500 events and when I search all time for HOSTA I on receive 10 events (from today)?? Why can't I access the events copied over? It's not a permissions issue?? Another thing I on a workgroup enviornment not an active directory domain. The user that I am logged in on is the same username on each system. ... View more

I am using the following script in /bin/scripts on splunk to send snmp traps from my windows server to my NMS and it is not working with no errors. I am troublshooting by running it from the command prompt and what I am noticing is that it is running each set and command as a separate command in windows vice as one unified script. Below is the script from the windows wiki this is exactly what I am using except I put in correct IP's etc... setlocal set SNMPAGENTHOST=127.0.0.1 set SNMPAGENTPORT=162 set TRAPOID=1.3.6.1.4.1.27389.1.2 set OID=1.3.6.1.4.1.27389.1.1 set SNMPCOMMUNITY=public set SNMPTRAPCMD=C:\usr\bin\snmptrap.exe for /f "usebackq" %%h in ( hostname ) do @set myhost=%%h set num=%~1 set num=%num:'=% set terms=%2 set query=%3 set sname=%4 set reason=%5 set permalink=%6 if "%8" == "" ( set resultspath=%7 ) else ( set tags=%7 set resultspath=%8 ) if "%8" == "" ( "%SNMPTRAPCMD%" -v 2c -c %SNMPCOMMUNITY% %SNMPAGENTHOST%:%SNMPAGENTPORT% "" %TRAPOID% %OID%.1 i %num% %OID%.2 s %terms% %OID%.3 s %query% %OID%.4 s %sname% %OID%.5 s %reason% %OID%.6 s %permalink% %OID%.8 s %resultspath% ) ELSE ( "%SNMPTRAPCMD%" -v 2c -c %SNMPCOMMUNITY% %SNMPAGENTHOST%:%SNMPAGENTPORT% "" %TRAPOID% %OID%.1 i %num% %OID%.2 s %terms% %OID%.3 s %query% %OID%.4 s %sname% %OID%.5 s %reason% %OID%.6 s %permalink% %OID%.8 s %resultspath% %OID%.7 s %tags% ) endlocal ... View more

Trying to create a custom warning banner on login page for splunk 5.0.1. Tried editing the web.conf file in /etc/system/local but the message did not appear...any suggestions are appreciated. Thanks! ... View more

I have an alert on my windows 2008R2 indexer that calls sendsnmptrap.cmd (see link to script below). My question is in this script it says to "Edit the agent host, port, community, and snmptrap.exe command path" which I did but I am unsure of if what the "set SNMPAGENTHOST= " should be. In their example they had the local loopback address 127.0.0.1 but if I put the ip of the indexer that doesn't work should it be the ip of my Network Management Server? Thanks! http://wiki.splunk.com/Community:Sending_SNMP_Traps_On_Windows ... View more

I am receiving the following message in the splunkd log on my UF (windows) 01-11-2013 09:47:35.129 -0500 ERROR TcpOutputFd - Connection to host=x.x.x.x:9997 failed 01-11-2013 09:47:35.129 -0500 WARN TcpOutputProc - Applying quarantine to idx=x.x.x.x:9997 numberOfFailures=2 01-11-2013 09:48:04.141 -0500 INFO TcpOutputProc - Removing quarantine from idx=x.x.x.x:9997 01-11-2013 09:48:05.072 -0500 WARN TcpOutputFd - Connect to x.x.x.x:9997 failed. No connection could be made because the target machine actively refused it. I can ping between the indexer and UF and nothing seems amiss. I cannot test with telnet b/c it is disabled. Any suggestions for troubleshooting is appreciated! Thanks! ... View more