We have a diskless windows infrastructure that has non-writable images. The splunk agent is installed in the image, and the hostname shows up for the diskless clients as $decideonstartup Any suggestions for best way to get the proper hostname for the events, would be greatly appreciated. Thanks ... View more

I am trying to extract the hostname from the name of the file selected as input. For input setup I have the following: Set Host = regex on path Regular Expression = _([^_]+).log$ Whitelist = *\.log$ file names and path look like this: (this is an nfs mounted share) /dev/data/runs/int_master__int_master_2012_03_20_15_48_39/logs/target_diag_manager_xray_int0001.log int0001.log is my hostname, but Splunk keeps flagging the hostname as dev0001, the splunk indexer, as the hostname. Suggestions, thoughts? ... View more

This worked fine under 4.2, upgraded to 4.3 and now it doesn't work. I increased the timeout, and I have another PDF that gets generated 15 mins later and it works fine. I've included the internal logs on the failure. Thoughts? 2012-02-22 05:45:32,525 INFO pdfhandler:558 - Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print https://logprod0001:8000/app/search/AllNIFErrorsLast24Hours -printmode pdf -printfile /tmp/tmpCaxJ1P -title Splunk Alert: AllNIFErrorsLast24Hours -orientation portrait -paperwidth 216 -paperheight 356 -mode splunk -timeout 600 -windowsize 782x768 -footer_right Generated by Splunk at &D -cookie session_id_8000=9679e771f9afe79bf973f49885a2e239c4147776 -P splunk 2012-02-22 05:45:32,525 INFO Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print https://logprod0001:8000/app/search/AllNIFErrorsLast24Hours -printmode pdf -printfile /tmp/tmpCaxJ1P -title Splunk Alert: AllNIFErrorsLast24Hours -orientation portrait -paperwidth 216 -paperheight 356 -mode splunk -timeout 600 -windowsize 782x768 -footer_right Generated by Splunk at &D -cookie session_id_8000=9679e771f9afe79bf973f49885a2e239c4147776 -P splunk 2012-02-22 05:45:59,983 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: Splunkd daemon is not responding: ('The read operation timed out',) 2012-02-22 05:45:59,983 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__conner9__search_X1NjaGVkdWxlZFZpZXdfX0FsbE5JRkVycm9yc0xhc3QyNEhvdXJz_at_1329918300_85edc076e2e8aa88?message_level=warn [] sessionSource=direct 2012-02-22 05:45:59,991 DEBUG simpleRequest < server responded status=200 responseTime=0.0075s 2012-02-22 05:45:59,991 DEBUG getStatus - elapsed=0.00764989852905 nextRetry=0.0500000035814 ... View more