Hi @smichalski , I’m a Community Moderator in the Splunk Community. This question was posted 4 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

If you are running a modern splunk version have you tried kvstore tools redux? https://splunkbase.splunk.com/app/5328/ ... View more

No, you don't have to use SC4S. ... View more

Did you ever find a resolution for this error?  We're running v7.3.2,  search head cluster, indexer cluster. It doesn't appear to affect the searches running, but multiple users are getting the "Server Error" message, usually after the job has finalized. Thanks. ... View more

Hello, I am curious if you have found another way to accomplish this.    For us, going through audit functions to a blob storage on a heavily used azure sql database is beyond painful and completely impractical.    ... View more

I'm not familiar with SQL Server, but you could join to a query similar to this in your db connect inputs to get the hostname (I know, horrible work-around, but we do something similar to get the database instance name): https://social.msdn.microsoft.com/Forums/officeocs/en-US/6720817d-120f-4099-bf0e-e97fd2e26848/how-to-get-host-name-and-sql-instance-name-by-tsql?forum=transactsql ... View more

I had run btool on props previously. I confirmed my sourcetype is active. ... View more

My answer is not "an approach"; it is a deployment and testing methodology regardless of what approach you do use. In other words, the problem is probably not in "your approach". ... View more

same issue 7.1.1 ... View more

great, please mark question as answered and up vote any comments answers that you think helped with resolution have a great weekend ... View more

I contacted support and this was their response, which worked for me: In DA-ESS-ThreatIntelligence/bin/configuration_checks/confcheck_failed_threat_download.py if you could change the line from the first line to the second job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest=earliest) job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest_time=earliest) ... View more

maybe, check this one - Configure Computers to Forward and Collect Events https://msdn.microsoft.com/en-us/library/cc748890(v=ws.11).aspx ... View more

That calculation is published in the Splunk® Enterprise Security Installation and Upgrade Manual in the section on Data model acceleration storage and retention I just looked it up and it also says "This formula assumes that you are using the recommended retention rates for the accelerated data models." Here is the link: http://docs.splunk.com/Documentation/ES/4.5.1/Install/Datamodels If you are seeing something really different from what the documentation suggests, I think you should file a support ticket. If you just stop accelerating the data models, I am concerned that it might have a negative effect on your Enterprise Security correlation searches and alerts... ... View more

For those curious, I figured out why it just started suddenly working. I didn't have 'Restart Splunk' selected for the app on the Deployment Manager. Again, TStrauch, thanks for the help with the monitor stanza. ... View more

Thank for letting us know this worked for you! ... View more

You are using the wrong REST endpoint, use this one, which allows you to access a list of SIDs by {name} http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fhistory ... View more

Google doesn't turn up any results, unfortunately. However, it looks like this app has moved to an open source model, so your best bet would be to try the mailing list. More info can be found here: Git Repo for Sharepoint TA You can also look at the issues list here on their github: Sharepoint TA Issues list ... View more

Also, I am not sure if you are familiar with our Splunk classes, but you might also be interested in checking out the Splunk 6 Administration class. It's an excellent class for getting really familiar with these concepts and applications. There are several prereqs. Details and upcoming schedule can be found here: https://inter.viewcentral.com/Events/cust/search_results.aspx?cid=splunk&pid=1&lid=1&tstamp=1446052233678&event_id=274&postingForm=catalog.aspx ... View more

Hi, You need to clean fishbucket on forwarder. 1.) Stop splunkforwarder 2.) Remove fishbucket or clean fishbucket 3.) Start splunkforwarder Thanks, Harshil ... View more

the inputs.conf is linear, and through researching this one it looks like that it can't be done. The reason is that the monitor stanza is actually a modular input from Splunk that contains a checkpoint dir. The checkpoint directory is what helps Splunk determine what events have already been sent or not so that you don't re-ingest the same data over and over. Since the inputs.conf file is linear it should always attach the sourcetype of the first stanza. You can test this theory by playing around with the order of the stanzas and re-ingesting a log file in those folders using btprobe with a --reset flag. Here is the link to the btprobe commands for reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/Troubleshooting/CommandlinetoolsforusewithSupport#btprobe I'm pretty sure that this can't be done they way you want it though. You can through an individual file based monitor but not a folder monitor. ... View more

Works great. Thanks! ... View more

Since you ruled out gzip itself as the culprit, this looks to me like a pipeline problem, and not exactly a gzip failure - which means the trouble would be in ArchiveProcessor. In other words ArchiveProcessor may not be handling the pipeline correctly (a bug! ... perhaps). There are at least 2 other possibly related issues to be found on this site: http://answers.splunk.com/answers/57272/large-data-archives-zip-being-corrupted-on-indexing.html http://answers.splunk.com/answers/132045/error-archiveprocessor-with-zip-files.html these refer to zip files, but i wonder if it might be common cause, specifically pipeline handling in the ArchiveProcessor logic. As an aside, i'm completely unsure if your issue is related, but these are food for thought: https://blog.nelhage.com/2010/02/a-very-subtle-bug/ http://bugs.python.org/issue1652 ... View more