Hi Do you have any updated on this? We are seeing the same problem. ... View more

Thank you! ... View more

No further comments have been received, so I assume that nobody has similar problems found and that anybody has checked his Apps... Posting this message as a kind of answer to "switch" the color of the question from red to green 😉 Stephan ... View more

OK, answering my own question... The analysis seems to be correct: if an index is defined in an indexes.conf file, which is contained in a .../default-directory, then this indexes will get recreated after a restart of Splunk! Even if this index was deleted completely. It will get the "deleted = true" flag, in the indexes.conf file residing in the .../local-directory. Thus you have to comment out the stanza for the index to be deleted in the /default/indexes.conf and to add the contexts to the /local/indexes.conf, THEN the index will get deleted completly during restart and it will NOT be recreated. Weird logic... and an exeception to the rule of not editing .conf-files inside a /default-directory... Have fun, Stephan ... View more

Could you check if you have installed the app "SA-cisco-asa"? If yes, then try to disable it, IF your version of the Cisco Security Suite is 3.1.0 (the newest one). I suspect some interferences between the older SA and the newer version of the Security Suite... Regards, Stephan ... View more

I tried this workaround as well. It works like a charm. Thanks trymo for providing this answer. ... View more

OK, I am pretty much shure, that this is related to the session-only duration of the cookie. What I did inside the MyUnifiAuth class to test this: - request.get with Login-String, this returned 200 - request.get with event-API-call, this returned 401, and a json-error "api.err.LoginRequired" Seems that this are actually two sessions... Thanks for supporting us!! I think, we should consider other (outside of Splunk) methods to retrieve the event list using an intermediate file. ... View more

Hi @swasserroth, The Splunk App for Windows Infrastructure does not require an additional license. The reference you saw was in error and has been removed. Apologies for the confusion. ... View more

I have run into the same problem: all dashboards I have created resulted in "No search query provided". After installing the "Dashboard Examples" I probably found the difference between these dashboards and the dashboards created in Splunk 6.2.1 by looking at the XML code differences: - Splunk-created dashboards contain the query strings inside a <query> markup, - the dashboard examples (i.e. "chart") are using the <searchString> markup. After manual conversion of the XML code of Splunk-created dashboards to a format identical to the "chart" example, the dashboard worked on the iPad as expected. It seems not to be an issue of using inline searches or not... ... View more

our new mobile add-on is release, please use this add-on instead: https://splunkbase.splunk.com/app/2887/ Also, please be aware that Splunk mobile app on IOS/android will only work on new add-on. ... View more