Hi Freeborn, Have you contacted Support about this issue? I don't know off the top, but I do know that these sort of issues often turn out to be environmental or setup-related. Even if it's truly a bug, we'd need more specifics to be able to troubleshoot effectively. I'd recommend filing a ticket. Thanks! ... View more

Its a server error. Check directory permissions, make sure splunk user has permissions to access both locations. ... View more

I followed the examples, but it ends up either sending all my data recived by uf, or it send all the data captured by syslog. I will do some further testing tonight and if it does not work I will post what I have. ... View more

What options do recommend for using rsync to move the splunk database (indexes) to the new server? I have my splunkDB outside of the /opt/splunk directory tree because it is a separate volume (raid array). I've already successfully used tar to get /opt/splunk over there and unpacked it and have it running, but I think that tar is not the tool for moving the index data as it is so large. I'm planning to shut down both splunk instances before moving the splunkdB, is there anything else to do before moving (copying it, actually). ... View more

I'm getting the same issue as stating in this post. Can someone help me? ... View more