We have a partner who wants an extremely light interface to send data into a Splunk instance. They prefer to make a simple REST call directly from the browser to load a JSON payload into Splunk. The goal is to NOT have a heavy server-side process, but rather a lightweight REST interface directly to Splunk. The data would be keyed on the user working in the browser at the time of the call out. The data would be accessed in a Splunk dashboard/report keying on the user and his/her data. I saw a recommendation from another post regarding HTTP Event Collector for this purpose. On first thought this seems feasible, but I am interested in knowing the pluses and minuses of both solutions. Regards. ... View more

Splunk searches return hostname by default -- where hostname is the value returned the linux command hostname. We have a partner whose VMs get refreshed frequently where the underlying ip changes, but the alias remains constant. What is the best way to have Splunk report the primary alias rather than the linux hostname? Regards. ... View more

I just repaired corrupt buckets for a partner index on one of our enterprise indexers. The issue only became apparent after the customer saw the warnings on their reports. My question is: are there easy proactive warnings the administrators can receive highlighting index bucket corruption -- rather than leaving it up to our customers to find the problems. ... View more

After upgrading from 6.3.7 to 6.5.2, we are getting the error on search: "Cannot get username when all users are selected". Some people are getting this and some aren't. We are also seeing different results for different browsers relative this error. Regards. ... View more

I am automating removing a search head (SH) instance from both the search head cluster and the index cluster. Removing the SH from the shcluster is easy, but removing the SH from the index cluster seems problematic -- assuming it is done via a CLI command and not by restarting the cluster master instance. The SH was added to the index cluster using the following command from the SH: ./splunk edit cluster-config -auth admin:${PASSWD} -mode searchhead -site ${SITE} -master_uri ${CLUSTERMSTR_URI} -replication_port 8080 -secret ${CLUSTERMSTR_PASSWD} Also from the SH, am trying to remove the SH from the index cluster using: ./splunk remove cluster-master -master_uri https://splunk-clustermstr-dev.fmrco.com:8089 -secret ${CLUSTER_PWD} result: In handler 'clustersearchheadconfig': Cannot remove this master. I also tried to run the following command from the cluster master: ./splunk remove cluster-peers -peers 8C842081-A220-4081-87AC-92915D567845 Result: In handler 'clustermastercontrol': Remove aborted, Reason: Cannot find peer with guid=8C842081-A220-4081-87AC-92915D567845 to remove. Wasn't sure why till running ./splunk list cluster-peers and saw that it is only showing indexer entries, not SH entries. I am hoping not to have to restart the cluster master instance to get rid of removed SH instances -- let me know how please. Regards. ... View more