Unfortunately, I don't have a solution to this issue. I've been having this issue for some time now and I still haven't identified the root-cause or a solution to resolve this. I've already engaged Splunk Support to assist with troubleshooting and have tried different configuration changes -- from increasing the ulimit, to changing the maxKBps throughput, to changing the MAXEVENTS settings. However, the issue persists. The weird thing is that this issue is only happening on half of the indexers (5 newly added indexers.) There are 10 indexers total in our Splunk infrastructure, 5 old indexers and 5 newly added indexers for expansion. The hardware specs of the servers are almost identical. But for some reason the "Saturated Event-Processing Queues" only happen on the 5 new indexers. Whenever this happens the affected indexers are still searcheable but the indexing stops and the load is distributed to the rest of the healthy indexers. For now, the band-aid approach is to restart the new indexers whenever the alert is triggered. This has become an annoying and painful daily process. I'd really appreciate it if someone out there have encountered this issue, successfully identified the root-cause and resolved this issue. Thank you very much. ... View more

Btw, the Time Picker works in Splunk Mobile App if the old tags are used. For example, the fieldset tag works when earliestTime and latestTime tags are used. However, even if you set the default value of the token in the dashoard Splunk Mobile App internally defaults to "All Time". That's why when you first open the dashboard it will run an All Time query. You can cancel the query by picking a new time from the time picker. This can be a performance hog the search head especially if there a lot of Splunk Mobile App users in your Enterprise installation. The quick and dirty workaround is to create dashboards with hardcoded time-range and just label the dashboard accordingly, i.e. Chart (Today), Chart (Yesterday), etc. ... View more

Perhaps someone at Splunk would consider support for an OCI / JDBC-Thick connect string, or a the ability to define the complete URI in the configuration file as an enhancement request? yes, i was thinking about submitting a feature request for Splunk DB Connect to support thick connection string and/or TNS connection. but i was hoping that there is some kind of a work around to connect to multiple hosts with the current version of DB Connect. thank you for confirming my suspicion though. ... View more

hi, here's the version. "Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64-bit Production With the Partitioning, Real Application Clusters, Automatic Storage Management and Real Application Testing Options" thanks! ... View more

i was able to get Splunk App for Stream to work by following the tips in this thread: http://answers.splunk.com/answers/150534/splunk-app-for-stream-installation-missing-directories-wire-data-input-and-splunk-is-running-as-root my plan it to be able to sniff network traffic directly from a network TAP. i posted a question about this in this thread: http://answers.splunk.com/answers/151001/how-to-install-and-configure-splunk-app-for-stream-with-a-network-tap-to-monitor-wire-data i hope this helps. enjoy! ... View more

thanks for the tip! ... View more

@mdickey_splunk thanks for the help. i finally (almost) got it to work. i'm now seeing the streamfwd logs. and i saw this message: "No capture devices found (must be root/Administrator)" better contact our sysadmins to give streamfwd root access 🙂 ... View more

P.S. I still don't see "streamfwd" in the Wire Data settings page but I just ran the query -> sourcetype="stream:http" and i'm now seeing HTTP data stream! awesome! 🙂 ... View more

Mike, I manually copied Splunk_TA_stream directory into $SPLUNK_HOME/etc/apps and i'm now able to see the "Wire data" option in the Data Inputs. Nice! However, when I click "Wire Data" I don't see "streamfwd" in the list. In fact, there are no items displayed on the Data Inputs > Wire Data page. I also checked $SPLUNK_HOME/var/log/splunk/stream_installer.log but this file does not exist in the log directory. Any ideas what I'm missing? Thanks! ... View more

I've encountered the same issue. It's also interesting to note that Splunk_TA_stream was installed under $SPLUNK_HOME/etc/apps/splunk_app_stream/install/ directory. ... View more