Greetings! We have configured the JMS Modular Input to be a durable subscriber to a JMS queue and we're happily retrieving data :thumbs-up: We are also doing this in a DEV/TEST environment. In this environment, (large) stack traces are sometimes in the JSON payloads which tips the event over 10,000 characters... at which point we see the event become truncated, which breaks the JSON structure and the use of spath :sad-face: Is there any setting anywhere that would allow me to disable/negate this? Regards, RT. ... View more

Hi Splunkers/Splunkettes, I have recently installed and configured the JMS Messaging Modular Input add-on a heavy forwarder, and I am unable to create a durable connection. In my configuration I use the Client ID: "SPLUNK#Consumer" as well as a few other simpler variations (SPLUNK_PREPROD & SK) and am still having no joy as Splunk is reporting the Client Id isn't set. (Sorry about the kruddy quality) Sure enough, WebMethods reports that the connection is coming from an unknown account and creates an ephemeral user (vclient20-67494 or something like that). We are able to get data, we are just not able to create a durable subscription of said data which is a problem. We have tested from non-Splunk applications and it functions as as expected. Is there something I'm missing here? Any and all help greatly appreciated! RT ... View more

Hi Splunkers! This is less of a question, and more of a (hopefully) handy tip that I hope will answer peoples questions when they go looking for an answer to timestamp extraction issues, specifically when setting TIMESTAMP_FORMAT in props.conf. If you're looking to get a timestamp in strptime/strftime format, I've found this site really useful: http://www.strftime.net/ It's not owned/run by me, and as far as I can tell has no ads. Hope it helps! RT 🙂 ... View more

Hi All, After fresh installs of Splunk (Windows v5.0.4) I had (had) a fully functioning cluster that was happily replicating and life was good. After updating an app on the cluster master (removing extraneous text files from a directory) I kicked of the bundle deployment: .\splunk.exe apply cluster-bundle I then checked the status with the following command: .\splunk.exe show cluster-bundle-status Output: Guid: 71F63992-BD86-4935-932E-24258A6A3CDD ServerName: IDX-A Status: Up Bundle Validation Status: Validation successful Latest Bundle: 1d6134c6cab9fd5a720516d8881a01a8 Active Bundle: 37b2f885aeac2bbe59bfa95a7a4202fc Guid: BC734690-BACE-41CC-812D-254085234EE5 ServerName: IDX-B Status: Restarting Bundle Validation Status: Validation successful Latest Bundle: 1d6134c6cab9fd5a720516d8881a01a8 Active Bundle: 37b2f885aeac2bbe59bfa95a7a4202fc All well and good, but when I checked again not long after: Guid: 71F63992-BD86-4935-932E-24258A6A3CDD ServerName: IDX-A Status: Restarting Bundle Validation Status: Validation successful Latest Bundle: 1d6134c6cab9fd5a720516d8881a01a8 Active Bundle: Guid: BC734690-BACE-41CC-812D-254085234EE5 ServerName: IDX-B Status: Up Latest Bundle: 1d6134c6cab9fd5a720516d8881a01a8 Active Bundle: 1d6134c6cab9fd5a720516d8881a01a8 The impact of this is: The Active Bundle for IDX-A is now blank The app directories in /slave-apps are now empty IDX-A is in a restart loop, and; The splunkd.log on IDX-A indicate that the process is being told (repeatedly) to gracefully shut down. This is not the first time this has happened... as this fresh install is a result of this happening previously and me taking the default "Reinstall & hope for the best" path... dammit. Any and all suggestions greatly appreciated! RT EDIT #1: 10 minutes later and it's still happening. EDIT #2: splunkd.log on the cluster master has this over & over again: ... CMMaster - event=handleInputsQuiesced guid=71F63992-BD86-4935-932E-24258A6A3CDD ClusterMasterPeerHandler - Add peer info replication_address=IDX-A forwarder_address= search_address= mgmtPort=8089 rawPort=9887 useSSL=false forwarderPort=0 forwarderPortUseSSL=true serverName=IDX-A activeBundleId= status=Up type=Initial-Add baseGen=0 CMMaster - event=removeOldPeer guid=71F63992-BD86-4935-932E-24258A6A3CDD hostport=IDX-A:8089 status=success CMMaster - event=addPeer guid=71F63992-BD86-4935-932E-24258A6A3CDD replication_address=IDX-A forwarder_address= search_address= mgmtPort=8089 rawPort=9887 useSSL=false forwarderPort=0 forwarderPortUseSSL=true serverName=SE02SPL01LP activeBundleId= status=Up type=Initial-Add baseGen=0 bucket_count=0 CMPeer - peer=71F63992-BD86-4935-932E-24258A6A3CDD transitioning from=Down to=Up reason="addPeer successful." CMMaster - event=addPeer msg='Bundle mismatch; restarting peer. ' CMMaster - committing gen=121 numpeers=2 CMMaster - event=addPeer guid=71F63992-BD86-4935-932E-24258A6A3CDD status=success initialized=1 npeers=2 basegen=121 CMPeer - peer=71F63992-BD86-4935-932E-24258A6A3CDD transitioning from=Up to=Restarting reason="restart peer" CMBundleServer - event=streamingbundle status=success file=C:\Program Files\Splunk\var\run\splunk\cluster\remote-bundle\4a483d66a10ab4976b2d984c9361d040-1382573311.bundle totalBytesWritten=3317760 checksum=1d6134c6cab9fd5a720516d8881a01a8 Content-Length=3317760 ClusterSlaveControlHandler - Bundle validation success reported by [71F63992-BD86-4935-932E-24258A6A3CDD] successful for bundleid=1d6134c6cab9fd5a720516d8881a01a8 CMMaster - event=handleShutdown guid=71F63992-BD86-4935-932E-24258A6A3CDD status=Restarting CMPeer - peer=71F63992-BD86-4935-932E-24258A6A3CDD has started master-initiated restart ... ... View more

Hello Splunkers and/or Powershell Gurus! I'm getting a bunch of errors when using the Splunk-on-Splunk TA for the collection of diagnostic data. I have enabled Powershell script execution, and I'm using the app as packaged deployed by a Cluster Master to an indexer. Each of the lines below is prefixed with: 10-24-2013 08:30:06.594 +1100 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\slave-apps\TA-sos_win\bin\sospowershell.cmd" ps_sos.ps1 The reported error: Error formatting a string: Index (zero based) must be greater than or equal to zero and less than the size of the argument list.. At C:\Program Files\Splunk\etc\slave-apps\TA-sos_win\bin\powershell\ps_sos.ps1:17 char:5 + $CMDLINE = "{0}" -f ($CMDLINE -replace '"',"") + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: ({0}:String) [], RuntimeExcept ion + FullyQualifiedErrorId : FormatError Any & all help greatly appreciated 🙂 ... View more