I had created one VM (EC2 in aws, centos) and attached splunk ebs volume to it, mounted on /opt. On this Server, Splunk is running well but indexes are showing 0 data in splunk web. Though I can see data at $SPLUNK_DB, for all of my application indexes indexes.conf having below conf [prod-abc] homePath = $SPLUNK_DB/prod-abc/db coldPath = $SPLUNK_DB/prod-abc/colddb coldToFrozenDir = $SPLUNK_DB/prod-abc/frozendb thawedPath = $SPLUNK_DB/prod-abc/thaweddb frozenTimePeriodInSecs = 63072000 maxDataSize = auto #If I create new index test and give below setting, change the path to absolute. It populate data in index: [prod-test] homePath = /opt/splunk/volr/splunk/prod-abc/db coldPath = /opt/splunk/volr/splunk//prod-abc/colddb coldToFrozenDir = /opt/splunk/volr/splunk//prod-abc/frozendb thawedPath = /opt/splunk/volr/splunk//prod-abc/thaweddb frozenTimePeriodInSecs = 63072000 maxDataSize = auto my splunk-launch.conf looks so- # Where splunk is installed. SPLUNK_HOME=/opt/splunk # Location where we want to store the indexed data. SPLUNK_DB=/volr/splunk # Splunkd daemon name SPLUNK_SERVER_NAME=splunkd # Splunkweb daemon name SPLUNK_WEB_NAME=splunkweb ... View more

Configuration I have given in indexes.conf : [volume:remote_store] remote.s3.encryption = sse-c remote.s3.encryption.sse-c.key_type = kms remote.s3.encryption.sse-c.key_refresh_interval = 86400 remote.s3.kms.auth_region = us-west-2 remote.s3.kms.key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" Splunk error while restarting services: Splunk> Australian for grep. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Problem parsing indexes.conf : The following issues were found with indexes configuration: Bad KMS key_id provided for volume=remote_store. key_id can be unique key ID or the Amazon Resource Name (ARN) of the CMK, or the alias name or ARN of an alias that points to the CMK. Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue ... View more

I have run a search query in Splunk which return all the events contained "API call" initiated from some "IP_address" . I have one lookup attacker_ip.csv which contain blacklisted IP. I need to compare "IP_address" from search result to "attacker_ip" in attacker.csv. And print all the events for which "IP" matched. Please help... ... View more