The error message is indicating that the cluster master is attempting to push .conf files for which is does not contain a valid SPEC file. For example the eventgen.conf does not exist as part of the default splunk install. Therefore if an app wants to leverage this file , it would need a corresponding SPEC file in order to utilize this eventgen.conf. Because this file is missing the bundle will flag the config as invalid and refuse to push it until it's resolved You can fix this issue in one of a few ways You can remove all instances of the problematic .conf files (this could possibly break app functionality) If you recently upgraded an app and started getting this issue, you should make sure that when you upgraded you did not leave in place any .conf files that are no longer leveraged by the app You can add in the spec files for the .conf files referenced, this will allow splunk to push out the cluster bundle and avoid the errors. You can push the bundle to ignore these errors by adding the --skip-validation flag (not recommended unless you know what you are doing as this could cause bad conf to get pushed out) If you find that an app is giving you these errors AND the spec file for that app is not included, you may want to alert the app developer of this problem. ... View more

HI Russell, The vmware trial (and normal license) uses a 0mb value. When splunk indexes it indexes against the actual license you have and does not count against the vmware license. The vmware license exists only to tell splunk you have purchased that app. The quota issue you cite sounds like a splunkd.log log message about a user going over disk quota. This is a separate issue which has to do with how much data each splunk search user can use on disk. If the error message are different than this please post examples. Additionally there is a known issue with the vmware license on 3.1.3 version of vmware app. If you are on this app I would advise that you upgrade to 3.1.4 ... View more

The issue here is that the EventCode=4662 needs to be surrounded by some sort of delimiter , per the following in inputs.conf In key/regex formn, the first character of the regex is the delimeter. Valid regexes look like: %regex% regex "regex" etc. The only restriction is that the delimiter cannot be within the regex itself. http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Inputsconf So if you instead add a delimiter , EventCode="4662" this will resolve the issue blacklist1=EventCode="4662" Message=”Object Type:s+(?!groupPolicyContainer)” should work ... View more

Have you made sure that the "splunk_vmware_admin" has added the "admin" role to its privileges? This is required and is a common reason why this issue occurs on new implementations. Please see below for further documentation of the issue: http://docs.splunk.com/Documentation/VMW/latest/Install/Installonyoursearchheadorindexer ... View more