Awesome! ... View more

you are a beautiful soul ... View more

Awesome, thanks. 😊 It worked. Note that in my case I also changed for SystemD : splunk enable boot-start -systemd-managed 1 -user splunk PS : I didn't find how to format the code like the others (inline, red text and pink background) 😪 that's the best I could do... ... View more

I think it is better to import network communcation logs and then update them in my solution. If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/ I created that solution and continuously adding new features. It is meant to host all sorts of nodes and relationships. And I can imagine that the network communication logs can be one of them. And then even combine with what is already defined in CMDB. ... View more

The new TA is only and supports ontap 9.7 ... View more

Hi! Don't know if it's of any help at this late stage, but I ran into the same (or at least a very similar issue). I was getting an 'Incorrect user or password' in the logs despite being very sure that I was getting the password correct. The password was an SSO one, but if I set the password through the WebEx control panel, the calls succeeded and I'm now seeing data being pushed into the index.  ... View more

Hey Spranta,  I'd installed the Python for Scientific Computing add-on as well, and I followed the steps of MLTK documentation while I was trying to get it working. My issue seems to be the MLTK missing files, not missing dependency though. ... View more

Hi, we our using the TA_Nix for all our Linux Systems without any Problems. Can you post your inputs.conf? Which Linux Systems do you want to monitor? Thanks Alex ... View more

We just found out it's not the lookup editor itself. We change our authentication methode from ldap to saml. Using SAML the lookup editor is behaving really strange, switching back to ldap everythings fine. Seems to be a permission issue  - we are still investigating. ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

This is actually mentioned in the (Default) server.conf since around ver. 6.6.x, in that Mongo DB aka. kvstore (not Splunk) does not support Forward-Secrecy ciphers i.e. Mongo needs to have RSA ones to work. # The following non-forward-secrecy ciphers were added to support the kv store: # AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256. ... View more

We hade a same issues because the collection user had a special character within the password. Seems to be the TA wasn't able to handle that. ... View more

Depens on which role your instance is acting. We sepperate the workload, some Server are Searchheads and some are responsible only for Indexing the Data. You can have a Search- and Indexinginstance on one Hardware, but it's not recommanded. https://docs.splunk.com/Documentation/Splunk/8.0.4/Overview/AboutSplunkEnterprisedeployments ... View more

Don't think so. I think you just need to get the relevant installer from https://www.python.org/downloads/windows/ to install python on that server. ... View more

The problem is caused by an input without the attribute mode defined. This attribute is required, without it the input definition is invalid. Therefore, the migration cannot operate on it. You must either define the mode for this input (batch, rising, advanced) or remove it completely before running the migration. ... View more

1.iostat 2.mpstat 3.netstat 4.nmon 5.strace And also there are some more monitoring software https://www.hpe.com/us/en/insights/articles/16-linux-server-monitoring-commands-you-really-need-to-know-1703.html for further more assistance to this topic visit Data Recovery Dubai ... View more

FYI: I added forms authentication to the Website Input app. That app is more for extracting information that monitoring for outages but it could be used for determining if the site is up too (since no matches would mean something was wrong). ... View more

Well, Do you have McAfee? I had a similiar issue with Python.exe McAfee was Blocking it. ... View more

Hi, i'm just started working splunk have same troubles getting the powershells running. What du you mean with running the Import-Module first? After clicking on Generate Lookups the csv Files are empty. I replaced the $SplunkHome with the correct path of the Universalforwarder Installation. And some furhter Questions.....I generate the Lookups on the Search Head or? This is a Linux Host, how can a Linux Host handle Powershell Scripts? Do i have to do something else? Do i have do deplay the addon /etc/apps/Splunk_for_SQLServer/appserver/addons/TA-SQLServer also to the universalforwarder running on the sql server? ... View more