Dear all, I am trying to use third party tools to centralize all the log and forward the log to Splunk. Because of some reason, I need to use this third tool instead of Splunk forwarder. I success to forward the log to Splunk. However, I find there is two host in the log. one of the IP is forwarder IP. Example host: 1.1.1.1 <- forwarder IP 2.2.2.2 <- real IP May I know is it possible to remove the forwarder IP from the log through Splunk? Thanks ... View more

Dear all, I tried to upgrade Splunk from 6.1.1 to 6.5 but I'm having some issues. The first time, there is an error during installation and it caused splunkd to disappeared in service manager. After that, I tried to install again and it was successful. However there is another problem. When I try to restart splunkd service, it show error 1067. I checked the log and how following message. D:\Program Files\Splunk\var\lib\splunk\persistentstorage\seqno_db : unable to open database file GetLastError(): 5 I tried to remove it and solve the issue but this message appears again when I restart the service. May i know what problem is? Thanks ... View more

Dear all, I just upgraded splunk to 6.5. After finished, I find cannot get WMI event from other server. The splunk server and other server are in same domain. I checked the log and it show following message. 10-25-2016 11:01:34.544 +0800 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - Unable to connect to WMI namespace "\HQ1\root\cimv2" (attempt to connect took 29.00 milliseconds) (error="Access is denied." HRESULT=80070005) Before upgrade, we created another credential for splunk to remote other server to get WMI event and it is work. However, it fail after upgrade to 6.5. May I know how to put those credential on splunk? ... View more

Dear all, I would like to schedule Dashboard PDF email on Monday and Sunday only. I try to type 0 11 star star 7&1 in Cron Expression but it only send email on Sunday. May I know how to make it send on Monday also? Thanks ... View more

Hi, I tried to created a new look up using "Lookup File Editor App for Splunk Enterprise" but it show a message "This lookup file could not be found", May I know how to solve it. Thanks ... View more

My splunk show the following message suddenly but I don know how to solve it. I tried to search 'ns_log' and 'ns_msg_lookup' but cannot find it. Please advice. Thanks The lookup table 'ns_msg_lookup' does not exist. It is referenced by configuration 'ns_log'. [subsearch]: The lookup table 'ns_msg_lookup' does not exist. It is referenced by configuration 'ns_log'. ... View more