hello rakesh issue has been resolved after i updated the gmail port to 465 and used ssl. ... View more

i found the issue. it seems that savedsearches.conf was not updated. so i updated and it started working fine. one clarifiication that i would need is in some blogs it is said to use port 587 and in some 465. what is the difference between the two. ... View more

hello rakesh - thanks for the help. It worked for inline command in search. below command worked and mail was received. index=main | head 5 | sendemail [email protected] server=smtp.gmail.com:465 subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw use_ssl=1 but scheduled alert is still taking the mail server incorrectly. i have tried updating the settings in emails settings and restarted the splunk. also checked the alert_actions.conf and it is set fine. python log for scheduled alert: 2016-01-31 01:13:10,979 CST ERROR sendemail:115 - Sending email. subject="Splunk Alert: Server error", results_link="http://Boopal-MindPalace:8000/app/search/@go?sid=scheduler__admin__search__RMD5d4bfbc9a7af21f58_at_1454224380_7", recipients="[u's.boopal@xxxx']", server="mail.mydomain.com" 2016-01-31 01:13:10,980 CST ERROR sendemail:378 - [Errno 10061] No connection could be made because the target machine actively refused it while sending mail to: [email protected] ... View more

i used internet explorer latest version and it is working. may be an issue with chrome. i will update chrome and post the status here ... View more

i am using chrome only. index=_internal error this is returning error but there is no output to the head 1| table _raw output for my own query. sorry for the confusion ... View more

nope still no output ... View more

there is no output for this as well. i cant attach file here as of now ... View more

also i imported the tutorial data only and no other events are present. still i get same issue ... View more

if you see this you already have instance listening. choose different port for your use netstat -an | find "9997" TCP 0.0.0.0:9997 0.0.0.0:0 LISTENING TCP 10.0.0.35:9997 10.0.0.9:49965 ESTABLISHED ... View more

any help here. this becoming too difficult ... View more

i am searching all the events that i have which is just under 100. i did try with stats command but still nothing just count was displayed as before ... View more

splunkd didnt show anything odd ... View more

there are multiple logs in C:\Program Files\Splunk\var\log\splunk . is there any particular log that you are looking for? ... View more

i still get the same error even after adding that ... View more

do we need to add this in limits.conf or inputs.conf? ... View more

is the inputs.conf file in etc\system\local that you have verified in forwarder? what would need to be changed ... View more

i have the same problem and in my case it is set up fine. enabled firewall on the port 9997 telnet is working from forwarder to receiver there is no encryption settings as per the inputs.conf file. i just have the default data in the inputs.conf file when i installed it. also the forwarders has the data as below [default] host = xxxx [WinEventLog://Application] disabled = 0 index = xxxx sourcetype = security receiver splunkd log is not being updated with senders information could you please help me in fixing this. ... View more

After enabling the firewall telnet is working and forwarder is able to connect to the indexer. but seeing the error below in forwarder log 01-04-2016 22:06:25.163 -0600 INFO TcpOutputProc - Connected to idx=10.0.0.35:9997 01-04-2016 22:06:29.607 -0600 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd_access.log'. 01-04-2016 22:06:29.616 -0600 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd_ui_access.log'. 01-04-2016 22:06:32.921 -0600 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - EvtDC::bind: Failed to get domain controller name with DsGetDcName: (1355) 01-04-2016 22:06:32.921 -0600 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - EvtDC::connectToDC: DsBind failed: (1355) 01-04-2016 22:06:32.921 -0600 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventLogChannel::init: Failed to bind to DC, dc_bind_time=25 msec 01-04-2016 22:15:02.025 -0600 INFO TcpOutputProc - Connection to 10.0.0.35:9997 closed. Connection closed by server. 01-04-2016 22:15:22.397 -0600 WARN TcpOutputProc - Cooked connection to ip=10.0.0.35:9997 timed out 01-04-2016 22:15:43.884 -0600 WARN TcpOutputProc - Cooked connection to ip=10.0.0.35:9997 timed out 01-04-2016 22:15:53.944 -0600 INFO TcpOutputProc - Connected to idx=10.0.0.35:9997 01-04-2016 22:30:33.323 -0600 INFO TcpOutputProc - Connection to 10.0.0.35:9997 closed. Connection closed by server. 01-04-2016 22:30:53.389 -0600 WARN TcpOutputProc - Cooked connection to ip=10.0.0.35:9997 timed out 01-04-2016 22:31:03.128 -0600 INFO TcpOutputProc - Connected to idx=10.0.0.35:9997 seeing the below message in receiver splunk web Received event for unconfigured/disabled/deleted index=wineventlog with source="source::WinEventLog:System" host="host::xxxx" sourcetype="sourcetype::WinEventLog:System". So far received events from 1 missingindex(es). i am trying to forward the windows event log from forwarder and below is the inputs.conf file from forwarder [default] host = xxxx [WinEventLog://Application] disabled = 0 index = xxxx sourcetype = security what could be the issue. i have created a new index as well in the receiver with that index name ... View more

opening up the firewall port helped resolve the problem ... View more

yes i cant establish a telnet to the port 9997 only and few other ports that i see in the netstat output i can establish a connection from forwarder ... View more

in the forwarder i see connection timeout error message in the splunkd logs. i have configured the forwarder when i was installing to send the data to receiver ip address in the port 9997. i will send you the complete data in the file in sometime ... View more