As you can see in the comments in this thread. This bug was fixed ages ago. Then another one popped up and was fixed. If you still have a problem with this functionality, you might have encountered yet another but. Just raise a case with support please. ... View more

Had a customer whose issue was resolved after adding both ports 8443(reverse proxy) and port 3002(The port splunk web is listening on) to dashboard_html_allowed_domains etc/apps/app_x/default/web.conf dashboard_html_allowed_domains = *.domain.com:xxxx Add the port number at the end of the allowed domains and should work.  ... View more

@wittenst1234 Thank you. These worked great. ... View more

Running Step 6. I was seeing: error while loading shared libraries: libcrypto.so.1.0.0: cannot open shared object file: No such file or directory Basically you are trying to run mongo flat from the file system but the dependencies (like openssl) arent install on the SYSTEM, theyre only installed in SPLUNK. Either the lib file needs to be installed under default path /usr/lib or the LIB path needs to be set as below export LD_LIBRARY_PATH=/opt/splunk/lib/:$LD_LIBRARY_PATH ... View more

We are working on Splunk 6.6 with a similar issue, did you people find a solution that except for removing sub searches / editing web.conf ? ... View more

You can't tell Splunk not to store the job, the search would break. The solution is to make sure that this directory/volume has sufficient space to store the temporary files for the searches that you run. ... View more