Hi, I have configured splunk with SAML authentication method and it was working fine until last week. We have updated the licence group on splunk get free enterprise version foe next six months. Since then we are not able to redirect to onelogin. I am seeing empty inputs under Access controls » Authentication method for SAML configuration. When trying to add again, getting error as "SAML has already been configured, Cannot add a new SAML configuration" Could some one guide me how do i delete existing set up and re configure SAML again? And also Reload authentication configuration is not working. I can see all settings under SPLUNK_HOME/etc/system/ local/authentication.conf. -Thanks ... View more

Hi, I am doing a clean up process to all of indexes and i need to know who (users) searched the indexes in last 30 days. If there is no search found to any of the index, i am going to apply retention policy on that index to keep minimum data on HOT bucket of that index. Tried with index=_audit action=search earliest=@d user!="splunk-system-user" user!=admin | stats values(search) by user But this doesn't resulted as index wise. Could some one let me know how do i use history function to find out if anyone has run searches against the indexes all of indexes in the last 30 days so that i can apply reduction on that. -Thanks ... View more

Hi, I wanted to apply a retention policy on a specific index which where i wanted to set frozenTimePeriodInSec = 31540000 and maxsize to 50 G. I have set these attributed in my index setting under $SPLUNK_HOME/etc/apps/local/indexes.conf. After restarting the splunk service, i am getting below message as /opt/splunk/etc/apps/launcher/local/indexes.conf, line 16: frozenTimePeriodInSec (value: 31540000). Invalid key in stanza [ops_metrics] in /opt/splunk/etc/apps/launcher/local/indexes.conf, line 51: frozenTimePeriodInSec (value: 31540000). Invalid key in stanza [email] in /opt/splunk/etc/system/local/alert_actions.conf, line 4: reportServerURL (value: ). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. What i am doing wrong here? Can some one help to set the required parameters on selected indexes? my index settings are here below [bod_access] coldPath = $SPLUNK_DB/bod_access/colddb homePath = $SPLUNK_DB/bod_access/db thawedPath = $SPLUNK_DB/bod_access/thaweddb bucketRebuildMemoryHint = 0 compressRawdata = 1 enableDataIntegrityControl = 0 enableOnlineBucketRepair = 1 enableTsidxReduction = 1 minHotIdleSecsBeforeForceRoll = 0 rtRouterQueueSize = rtRouterThreads = suspendHotRollByDeleteQuery = 0 syncMeta = 1 timePeriodInSecBeforeTsidxReduction = 345600 frozenTimePeriodInSec = 31540000 maxTotalDataSizeMB = 50000 thanks ... View more

Hi, I wanted to apply data retention policy on splunk enterprise for the first time (as of now this is default) as per below criteria. All indexes will have the last 12 months of data available for search "hot bucket" After this, data will roll to the "warm bucket" for 3 months. Then the "cold bucket" for 3 months. After 18 months all incoming data is effectively irrecoverable from Splunk. This will be great of someone cloud share me how exactly this can be done and how to set the indexes.conf. -Thanks ... View more

Hi, My splunk app is configured with LDAP authentication method and there is a bunch of users who left and they need to delete from splunk. How do i delete permanently. The users do not have any ownership of any apps and searches. -thanks ... View more

While accessing splunk through Onelogin, i am getting a error message on the splunk login page as "The 'role' field is missing in the saml response from the IdP. Fix the configuration in the IdP to include 'role' in the saml response to complete login successfully. Click here to return to Splunk." How do i fix this with splunk SAML configuration. -Thanks ... View more

I have configured SAML SSO with Onelogin. My splunk app http://:8000/ is redirecting succusfully to Assertion consumer URL but getting an error message on spunk login page which does not allowing me to login with onelogn credentials "Verification of SAML assertion using the IDP's certificate provided failed. Error: Failed to verify signature with cert :/opt/splunk/etc/auth/idpCerts/idpCert.pem;" I have copied IdPCert.pem in required path /etc/auth/IdPCerts/ Does any one know who do i fix this? -Thanks ... View more

Can anyone tell what is the term "Audience" in SAML configuration while setting up splunk with one login SAML. My splunk app is redirecting to one login successfully but getting below error as 404 Not Found Return to Splunk home page Page not found! View more information about your request (request ID = 59157f073a7f6ae403eb50) in Search ... View more

Hi, I am configuring Splunk access control with SAML onelogin and I have uploaded the onelogin IdP meta data file to splunk. After configuration splunk app is redirecting to onelogin login page. But getting a message like "Federation Exception: Missing Assertion Consumer Service URL. Please contact your administrator." Does any one know how do i get Consumer URL for splunk ? -thanks ... View more

Hi I am suing splunk enterprise version 6.5 and my current authentication mode is LDAP. What is the procedure to migrate the auth mode from LDAP to SSO. What are the necessary files i need to take backup for this. -Thanks ... View more

I have Installed a Splunk universal forwarder on a Windows host and started the services. But while adding the data under "Add data" in my Splunk app, I am not able to see the installed Windows machine on list of forwarders. Is that something I need to edit the inputs.conf on the forwarder? Could someone share steps to send logs from Windows machine to a Splunk server (linux)? ... View more

What is the best way to delete or re-assign the orphaned searches?. I have around more than 100 orphaned searches which i need to re-assign them to someone other users. I read this can be done be deleting the searches directly from limits.meta file But i am not sure which is the exact file file i can use for this. ... View more

I need to get UDP traffic for a specific host from searches. How do I configure this or search ... View more

need to identify high cpu usage searches and stop them. ... View more